CVE-2025-42990 — HTML Injection in Unprotected SAPUI5 applications

CVE-2025-42990

HTML Injection in Unprotected SAPUI5 applications PUBLISHED

Description (CNA)

Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled URL. This issue could impact the integrity of the application. Confidentiality or Availability are not impacted.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAPUI5 applications	affected SAP_UI 750; affected 754; affected 755; affected 756; affected 757; affected 758; affected UI_700 200

CWE

CWE-79

References

https://me.sap.com/notes/3601169
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.