Open Redirect in SAP Se Netweaver Application Server Abap
CVE-2025-42981
Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script at a location not properly sanitized. When a victim clicks on this link, the script executes within the victim's browser, redirecting them to a site controlled by the attacker. This allows the attacker to access and/or modify restricted information related to the web client. While the vulnerability poses no impact on data availability, it presents a considerable risk to confidentiality and integrity.
Vulnerability class: Open Redirect
EPSS: 0.002 (11.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Sap_se Sap Netweaver Application Server Abap — versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-42981?
- CVE-2025-42981 is a medium-severity vulnerability in SAP Se Netweaver Application Server Abap, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.1/10. Published 2025-07-08.
- How severe is CVE-2025-42981?
- Medium severity. CVSS v3 base score is 6.1 out of 10.