CVE-2025-42884 — JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal

CVE-2025-42884

JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal PUBLISHED

Description (CNA)

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP NetWeaver Enterprise Portal	affected EP-BASIS 7.50; affected EP-RUNTIME 7.50

CWE

CWE-943

References

https://me.sap.com/notes/3660969
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.