JNDI Injection Vulnerability in SAP NetWeaver Enterprise Portal

CVE-2025-42884

What is CVE-2025-42884?

The vulnerability affects the SAP NetWeaver Enterprise Portal, where an unauthenticated attacker can exploit the system to inject JNDI environment properties. This manipulation enables attackers to pass malicious URLs during JNDI lookup operations, potentially granting unauthorized access to unintended JNDI providers. Such exposure could lead to the disclosure or unauthorized modification of sensitive information regarding the server. Nevertheless, it does not affect the operational availability of the service.

References