CVE-2025-42962 — Cross-Site Scripting (XSS) vulnerability in SAP Business Warehouse (Business Explorer Web 3.5 loading animation)

Description (CNA)

SAP Business Warehouse (Business Explorer Web) allows an attacker to create a malicious link. If an authenticated user clicks on this link, the injected script gets executed within the scope of victim�s browser. This potentially leads to an impact on confidentiality and integrity. Availability is not impacted.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Business Warehouse (Business Explorer Web 3.5 loading animation)	affected DW4CORE 100; affected 200; affected 300; affected 400; affected 916; affected SAP_BW 730; affected 731; affected 740; affected 750; affected 751; affected 752; affected 753; affected 754; affected 756; affected 757; affected 758

CWE

CWE-79

References

https://me.sap.com/notes/3604212
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.