CVE-2025-42924

MediumCVSS 6.1/10Last modified Oct 18, 2026

Description

SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be redirected to the page controlled by the attacker. This has low impact on confidentiality and integrity of the application with no impact on availability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-429254.3Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low CVE-2025-429265.3SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the CVE-2025-429273.4SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of kno CVE-2025-429289.1Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code executi CVE-2025-429298.1Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database table CVE-2025-42935.4A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /ad CVE-2025-429306.5SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that CVE-2025-429338.8When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This lea CVE-2025-429344.3SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert unt CVE-2025-429354.1The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM) permits authorized users with admin privile CVE-2025-429365.4The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user rol CVE-2025-429379.8SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could trav