CVE-2025-42886
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
SAP Business Connector contains a Reflected Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can create a malicious link and make it publicly accessible. When an authenticated victim opens the link, the injected input executes in their browser.
Risk Assessment
An attacker may access or modify information within the victim's browser scope. This impacts confidentiality and integrity, while availability remains unaffected.
Recommendation
Update SAP Business Connector to a patched version. Implement output encoding and security headers (CSP) and train users to recognize suspicious links.
Other vulnerabilities in SAP Business Connector
See all- CVE-2025-42894Medium
Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system.
- CVE-2025-42893Medium
Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site displayed within an embedded frame. Successful exploitation could allow the attacker to steal sensitive information and perform unauthorized actions, impacting the confidentiality and integrity of web client data. There is no impact to system availability resulting from this vulnerability.
- CVE-2025-42892Medium
An OS Command Injection vulnerability exists in SAP Business Connector. An authenticated attacker with administrative access and adjacent network access could upload specially crafted content that, when processed, enables execution of arbitrary operating system commands.
Original NVD description (English source)
Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim's browser context. This could allow the attacker to access or modify information within the victim�s browser scope, impacting confidentiality and integrity, while availability remains unaffected
Vulnerability data from NVD (NIST) · CISA KEV · EPSS