Information Disclosure in SAP NetWeaver Application Server Java

CVE-2025-42919

What is CVE-2025-42919?

An Information Disclosure vulnerability has been identified in SAP NetWeaver Application Server Java, allowing unauthenticated attackers to exploit the server by manipulating URLs. By inserting arbitrary path components into requests, attackers can gain access to sensitive internal metadata files, leading to unauthorized visibility of application information. This vulnerability raises significant concerns regarding the confidentiality of sensitive data while the integrity and availability of the application server remain intact. It is crucial for users of affected versions to apply the necessary security patches to mitigate this risk.

References