CVE-2025-42884

MEDIUM

SAP NetWeaver Enterprise Portal - Info Disclosure

Title source: llm

Description

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availability.

References (2)

[Vendor Advisory] https://me.sap.com/notes/3660969

[Vendor Advisory] https://url.sap/sapsecuritypatchday

Scores

CVSS v3 6.5

EPSS 0.0013

EPSS Percentile 32.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-943

Status published

Products (2)

SAP_SE/SAP NetWeaver Enterprise Portal EP-BASIS 7.50

SAP_SE/SAP NetWeaver Enterprise Portal EP-RUNTIME 7.50

Published Nov 11, 2025

Tracked Since Feb 18, 2026