CVE-2025-42909
Security Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances
- State
- Published
- Severity
- 3.0 Low
- Published
- Oct 14, 2025
- Updated
- Oct 14, 2025
- Reserved
- Apr 16, 2025
Description
SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in an existing SAP CAL appliances to gain access to other appliances. This has low impact on confidentiality of the application, integrity and availability is not impacted.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.0 Low | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N | sap |
Weaknesses
- CWE-1004 Sensitive Cookie Without HttpOnly Flag
Affected Products
| Product | Versions |
|---|---|
SAP Cloud Appliance Library AppliancesSAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.