What is CVE-2025-42909?

CVE-2025-42909 is a low-severity vulnerability in Sap Se Cloud Appliance Library Appliances, classified under Sensitive Cookie Without 'HttpOnly' Flag. CVSS score: 3.0/10. Published 2025-10-14.

How severe is CVE-2025-42909?

Low severity. CVSS v3 base score is 3.0 out of 10.

Vulnerability in Sap Se Cloud Appliance Library Appliances

CVE-2025-42909

SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in an existing SAP CAL appliances to gain access to other appliances. This has low impact on confidentiality of the application, integrity and availability is not impacted.

EPSS: 0.002 (13.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.0 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N.

Affected products

Sap_se Sap Cloud Appliance Library Appliances — versions TITANIUM_WEBAPP 4.0

Weakness classification (CWE)

CWE-1004 — Sensitive Cookie Without 'HttpOnly' Flag

References

Frequently asked questions

What is CVE-2025-42909?: CVE-2025-42909 is a low-severity vulnerability in Sap Se Cloud Appliance Library Appliances, classified under Sensitive Cookie Without 'HttpOnly' Flag. CVSS score: 3.0/10. Published 2025-10-14.
How severe is CVE-2025-42909?: Low severity. CVSS v3 base score is 3.0 out of 10.