Cross-Site Scripting Vulnerability in SAP Business Warehouse by SAP
CVE-2025-42962

6.1MEDIUM

Key Information:

Vendor

SAP
Status
SAP Business Warehouse (business Explorer Web 3.5 Loading Animation)
Vendor
CVE Published:
8 July 2025

What is CVE-2025-42962?

A vulnerability exists in SAP Business Warehouse (Business Explorer Web) that enables attackers to craft malicious links. If these links are clicked by an authenticated user, an injected script executes in the context of the user’s browser. This can compromise the confidentiality and integrity of sensitive information accessed through the application, while the system's availability remains unaffected.

Affected Version(s)

SAP Business Warehouse (Business Explorer Web 3.5 loading animation) DW4CORE 100

SAP Business Warehouse (Business Explorer Web 3.5 loading animation) 200

SAP Business Warehouse (Business Explorer Web 3.5 loading animation) 300

References

https://me.sap.com/notes/3604212
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-42962 : Cross-Site Scripting Vulnerability in SAP Business Warehouse by SAP