CVE-2025-42884
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider. This could further lead to disclosure or modification of information about the server. There is no impact on availability.
Risk Assessment
An attacker could access or modify sensitive server information, potentially compromising system and data security. The lack of availability impact means the service remains active, making detection harder.
Recommendation
Immediately apply SAP security updates provided by the vendor to eliminate the vulnerability. Additionally, restrict portal access from untrusted networks and monitor for unusual JNDI operations.
Other vulnerabilities in SAP NetWeaver Enterprise Portal
See all- CVE-2026-89122Medium
SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, potentially allowing tracking of user information and defacement of parts of the page.
- CVE-2026-89118Medium
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information. This leads to low impact on confidentiality, with no impact on integrity and availability.
- CVE-2026-89117Medium
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, potentially leading to session information theft, portal content manipulation, or user redirection.
- CVE-2026-44759Medium
A vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited.
- CVE-2025-42872Medium
XSS vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts that execute in the context of other users' browsers, enabling theft of session cookies, tokens, and other sensitive information. The impact on confidentiality and integrity is low, and no impact on availability.
- CVE-2023-33985Medium
SAP NetWeaver Enterprise Portal version 7.50 does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability. Successful exploitation allows an attacker to view or modify information, causing limited impact on confidentiality and integrity of the application.
Original NVD description (English source)
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS