CVE-2025-42872 — Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

CVE-2025-42872

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal PUBLISHED

Description (CNA)

Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a result, the vulnerability has a low impact on confidentiality and integrity and no impact on availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP NetWeaver Enterprise Portal	affected EP-RUNTIME 7.50

CWE

CWE-489

References

https://me.sap.com/notes/3662622
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.