Vulnerability-Lookup

CNVD-2025-21209

Vulnerability from cnvd - Published: 2025-09-12

Title

SAP NetWeaver ABAP Platform跨站脚本漏洞

Description

NetWeaver ABAP Platform是一个由SAP提供的企业级应用开发和部署平台。 NetWeaver ABAP Platform存在跨站脚本漏洞。攻击者可利用该漏洞生成恶意链接并使其公开访问，当认证用户点击此链接时，注入的输入会在网站页面生成过程中被处理，导致恶意内容创建，一旦执行这些恶意内容，攻击者可利用该漏洞获取或修改受害者浏览器范围内的信息。

Severity

中

Patch Name

SAP NetWeaver ABAP Platform跨站脚本漏洞的补丁

Patch Description

Formal description

厂商已提供漏洞修复方案，请关注厂商主页更新： https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2025.html

Reference

https://me.sap.com/notes/3629871 https://url.sap/sapsecuritypatchday

Impacted products

Name
SAP NetWeaver ABAP Platform

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-42948",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-42948"
    }
  },
  "description": "NetWeaver ABAP Platform\u662f\u4e00\u4e2a\u7531SAP\u63d0\u4f9b\u7684\u4f01\u4e1a\u7ea7\u5e94\u7528\u5f00\u53d1\u548c\u90e8\u7f72\u5e73\u53f0\u3002\n\nNetWeaver ABAP Platform\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u751f\u6210\u6076\u610f\u94fe\u63a5\u5e76\u4f7f\u5176\u516c\u5f00\u8bbf\u95ee\uff0c\u5f53\u8ba4\u8bc1\u7528\u6237\u70b9\u51fb\u6b64\u94fe\u63a5\u65f6\uff0c\u6ce8\u5165\u7684\u8f93\u5165\u4f1a\u5728\u7f51\u7ad9\u9875\u9762\u751f\u6210\u8fc7\u7a0b\u4e2d\u88ab\u5904\u7406\uff0c\u5bfc\u81f4\u6076\u610f\u5185\u5bb9\u521b\u5efa\uff0c\u4e00\u65e6\u6267\u884c\u8fd9\u4e9b\u6076\u610f\u5185\u5bb9\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u6216\u4fee\u6539\u53d7\u5bb3\u8005\u6d4f\u89c8\u5668\u8303\u56f4\u5185\u7684\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5df2\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2025.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-21209",
  "openTime": "2025-09-12",
  "patchDescription": "NetWeaver ABAP Platform\u662f\u4e00\u4e2a\u7531SAP\u63d0\u4f9b\u7684\u4f01\u4e1a\u7ea7\u5e94\u7528\u5f00\u53d1\u548c\u90e8\u7f72\u5e73\u53f0\u3002\r\n\r\nNetWeaver ABAP Platform\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u751f\u6210\u6076\u610f\u94fe\u63a5\u5e76\u4f7f\u5176\u516c\u5f00\u8bbf\u95ee\uff0c\u5f53\u8ba4\u8bc1\u7528\u6237\u70b9\u51fb\u6b64\u94fe\u63a5\u65f6\uff0c\u6ce8\u5165\u7684\u8f93\u5165\u4f1a\u5728\u7f51\u7ad9\u9875\u9762\u751f\u6210\u8fc7\u7a0b\u4e2d\u88ab\u5904\u7406\uff0c\u5bfc\u81f4\u6076\u610f\u5185\u5bb9\u521b\u5efa\uff0c\u4e00\u65e6\u6267\u884c\u8fd9\u4e9b\u6076\u610f\u5185\u5bb9\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u6216\u4fee\u6539\u53d7\u5bb3\u8005\u6d4f\u89c8\u5668\u8303\u56f4\u5185\u7684\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP NetWeaver ABAP Platform\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "SAP NetWeaver ABAP Platform"
  },
  "referenceLink": "https://me.sap.com/notes/3629871\r\nhttps://url.sap/sapsecuritypatchday",
  "serverity": "\u4e2d",
  "submitTime": "2025-08-18",
  "title": "SAP NetWeaver ABAP Platform\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2025-42948 (GCVE-0-2025-42948)

Vulnerability from cvelistv5 – Published: 2025-08-12 02:08 – Updated: 2025-08-13 20:20

Title

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform

Summary

Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation, resulting in the creation of malicious content. When this malicious content gets executed, the attacker could gain the ability to access/modify information within the scope of victim�s browser.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-12 13:30 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation

Assigner

sap mitre root

References

2 references

URL	Tags
https://me.sap.com/notes/3629871
https://url.sap/sapsecuritypatchday

Impacted products

1 product

Vendor	Product	Version
SAP_SE	SAP NetWeaver ABAP Platform	Affected: S4CRM 100 Affected: 200 Affected: 204 Affected: 205 Affected: 206 Affected: S4CEXT 107 Affected: 108 Affected: 109 Affected: BBPCRM 713 Affected: 714

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-42948",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-12T13:30:49.949065Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-13T20:20:27.593Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver ABAP Platform",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "S4CRM 100"
            },
            {
              "status": "affected",
              "version": "200"
            },
            {
              "status": "affected",
              "version": "204"
            },
            {
              "status": "affected",
              "version": "205"
            },
            {
              "status": "affected",
              "version": "206"
            },
            {
              "status": "affected",
              "version": "S4CEXT 107"
            },
            {
              "status": "affected",
              "version": "108"
            },
            {
              "status": "affected",
              "version": "109"
            },
            {
              "status": "affected",
              "version": "BBPCRM 713"
            },
            {
              "status": "affected",
              "version": "714"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDue to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website\ufffds page generation, resulting in the creation of malicious content. When this malicious content gets executed, the attacker could gain the ability to access/modify information within the scope of victim\ufffds browser.\u003c/p\u003e"
            }
          ],
          "value": "Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website\ufffds page generation, resulting in the creation of malicious content. When this malicious content gets executed, the attacker could gain the ability to access/modify information within the scope of victim\ufffds browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-12T02:08:17.608Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3629871"
        },
        {
          "url": "https://url.sap/sapsecuritypatchday"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2025-42948",
    "datePublished": "2025-08-12T02:08:17.608Z",
    "dateReserved": "2025-04-16T13:25:37.188Z",
    "dateUpdated": "2025-08-13T20:20:27.593Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.