CVE-2025-42893
Open Redirect vulnerability in SAP Business Connector
- State
- Published
- Severity
- 6.1 Medium
- Published
- Nov 11, 2025
- Updated
- Nov 12, 2025
- Reserved
- Apr 16, 2025
Description
Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site displayed within an embedded frame. Successful exploitation could allow the attacker to steal sensitive information and perform unauthorized actions, impacting the confidentiality and integrity of web client data. There is no impact to system availability resulting from this vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | sap |
Weaknesses
- CWE-601 URL Redirection to Untrusted Site
Affected Products
| Product | Versions |
|---|---|
SAP Business ConnectorSAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.