CVE-2025-42893
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site displayed within an embedded frame. Successful exploitation could allow the attacker to steal sensitive information and perform unauthorized actions, impacting the confidentiality and integrity of web client data. There is no impact to system availability resulting from this vulnerability.
Risk Assessment
An attacker can exploit user trust to redirect them to a malicious site, potentially leading to phishing and data theft.
Recommendation
Update SAP Business Connector to the latest version. Additionally, implement redirect validation mechanisms and educate users about suspicious links.
Other vulnerabilities in SAP Business Connector
See all- CVE-2025-42894Medium
Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system.
- CVE-2025-42892Medium
An OS Command Injection vulnerability exists in SAP Business Connector. An authenticated attacker with administrative access and adjacent network access could upload specially crafted content that, when processed, enables execution of arbitrary operating system commands.
- CVE-2025-42886Medium
SAP Business Connector contains a Reflected Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can create a malicious link and make it publicly accessible. When an authenticated victim opens the link, the injected input executes in their browser.
Original NVD description (English source)
Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site displayed within an embedded frame. Successful exploitation could allow the attacker to steal sensitive information and perform unauthorized actions, impacting the confidentiality and integrity of web client data. There is no impact to system availability resulting from this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS