Stored Cross-Site Scripting Vulnerability in SAP NetWeaver Application Server Java
CVE-2025-0054

5.4MEDIUM

Key Information:

Vendor
SAP
Status
SAP Netweaver Application Server Java
Vendor
CVE Published:
11 February 2025

Summary

A stored cross-site scripting vulnerability exists in SAP NetWeaver Application Server Java, allowing attackers with basic user privileges to inject malicious JavaScript payloads. When executed, these payloads can compromise the security of users' web browsers, enabling attackers to read or manipulate information on affected web pages. This vulnerability highlights the critical need for robust input validation in web applications to mitigate potential risks.

Affected Version(s)

SAP NetWeaver Application Server Java EP-BASIS 7.50

SAP NetWeaver Application Server Java FRAMEWORK-EXT 7.50

References

https://me.sap.com/notes/3526203
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.