CVE-2025-42872
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
XSS vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts that execute in the context of other users' browsers, enabling theft of session cookies, tokens, and other sensitive information. The impact on confidentiality and integrity is low, and no impact on availability.
Risk Assessment
Risk of session theft and sensitive data of portal users, which may lead to unauthorized access to the system.
Recommendation
Apply patches provided by SAP for SAP NetWeaver Enterprise Portal to eliminate the XSS vulnerability.
Other vulnerabilities in SAP NetWeaver Enterprise Portal
See all- CVE-2026-44759Medium
A vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited.
- CVE-2023-33985Medium
SAP NetWeaver Enterprise Portal version 7.50 does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability. Successful exploitation allows an attacker to view or modify information, causing limited impact on confidentiality and integrity of the application.
Original NVD description (English source)
Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a result, the vulnerability has a low impact on confidentiality and integrity and no impact on availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS