Riskcovery

CVE-2025-42975

Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document)

State
Published
Severity
6.1 Medium
Published
Aug 12, 2025
Updated
Aug 13, 2025
Reserved
Apr 16, 2025

Read the record on cve.org

Description

SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document application, embeds a malicious script. When a victim clicks on this link, the script executes in the victim's browser, allowing the attacker to access and/or modify information related to the web client without affecting availability.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsap

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation

Affected Products

ProductVersions
SAP NetWeaver Application Server ABAP (BIC Document)SAP_SE
  • S4COREOP 104Affected
  • 105Affected
  • 106Affected
  • 107Affected
  • 108Affected
  • SEM-BW 600Affected
  • 602Affected
  • 603Affected
  • 604Affected
  • 605Affected
  • 634Affected
  • 736Affected
  • 746Affected
  • 747Affected
  • 748Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.