cveboard RSS feed

CVE-2025-42908

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2025
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP

Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allow the attacker to perform actions and execute transactions that would normally require specific permissions, compromising the integrity and confidentiality of the system by enabling unauthorized access to restricted functionality. There is no impact to availability from this vulnerability.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

SAP NetWeaver Application Server for ABAP

Vendor
SAP_SE
Product
SAP NetWeaver Application Server for ABAP
Platforms
Unknown
Default status
unaffected
SAP NetWeaver Application Server for ABAP · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
KRNL64UC 7.53affectedUnavailableUnavailableUnavailableNone listed
KERNEL 7.53affectedUnavailableUnavailableUnavailableNone listed
7.54affectedUnavailableUnavailableUnavailableNone listed
7.77affectedUnavailableUnavailableUnavailableNone listed
7.89affectedUnavailableUnavailableUnavailableNone listed
7.93affectedUnavailableUnavailableUnavailableNone listed
9.16affectedUnavailableUnavailableUnavailableNone listed