CVE-2025-42883
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an administrative user uploads files to the application server. This could allow uploading a malicious file into the system, with low impact on application integrity.
Risk Assessment
An administrator or attacker with administrative privileges could introduce a malicious file into the system, bypassing malware controls. Integrity impact is rated low.
Recommendation
Update SAP NetWeaver to a patched version or implement external scanning of uploaded files. Restrict administrative privileges to the minimum necessary.
Other vulnerabilities in SAP NetWeaver Application Server for ABAP
See all- CVE-2025-42882Medium
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details could further assist the attacker in planning subsequent attacks.
- CVE-2025-42908Medium
Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allow the attacker to perform actions and execute transactions that would normally require specific permissions, compromising the integrity and confidentiality of the system by enabling unauthorized access to restricted functionality. There is no impact to availability from this vulnerability.
Original NVD description (English source)
Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges uploads files to the application server. An attacker could leverage this and upload a malicious file into the system. This results in a low impact on the integrity of the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS