Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2025-42908

Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allow the attacker to perform actions and execute transactions that would normally require specific permissions, compromising the integrity and confidentiality of the system by enabling unauthorized access to restricted functionality. There is no impact to availability from this vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP NetWeaver Application Server for ABAP

Default version status: unaffected

  • KRNL64UC 7.53affected
  • KERNEL 7.53affected
  • 7.54affected
  • 7.77affected
  • 7.89affected
  • 7.93affected
  • 9.16affected

References