Reverse Tabnabbing Vulnerability in SAP Fiori Launchpad

CVE-2025-42941

What is CVE-2025-42941?

SAP Fiori (Launchpad) suffers from a reverse tabnabbing vulnerability due to insufficient protections against external navigation for its link elements. An attacker could exploit this flaw by leveraging compromised or malicious web pages, potentially resulting in unauthorized manipulation of user sessions or the exposure of confidential information. Although administrative user privileges may facilitate exploit configurations, they are not required to carry out the attack. This vulnerability raises significant concerns regarding the confidentiality and integrity of the SAP Fiori system, although system availability remains untouched.

References