XSS in Sap Se Data Services (Dq Report)
CVE-2025-42973
Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associated with DQ job status reports. By intercepting requests, malicious script can be injected and subsequently executed when a user loads the affected page. This results in a limited impact on the confidentiality and integrity of user session information, while availability remains unaffected.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (7.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Sap_se Sap Data Services (Dq Report) — versions SBOP_DS_MANAGEMENT_CONSOLE 4.3, 2025
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-42973?
- CVE-2025-42973 is a medium-severity vulnerability in Sap Se Data Services (Dq Report), classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-07-08.
- How severe is CVE-2025-42973?
- Medium severity. CVSS v3 base score is 5.4 out of 10.