CVE-2025-42901

MEDIUM

SAP Application Server for ABAP (BAPI Browser) - Authenticated Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Description

SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affected functionality of BAPI explorer. This has low impact on confidentiality and integrity with no impact on availability of the application.

References (2)

Core 2
Core References

Scores

CVSS v3 5.4
EPSS 0.0003
EPSS Percentile 9.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-94
Status published
Products (15)
SAP_SE/SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 700
SAP_SE/SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 701
SAP_SE/SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 702
SAP_SE/SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 731
SAP_SE/SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 740
SAP_SE/SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 750
SAP_SE/SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 751
SAP_SE/SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 752
SAP_SE/SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 753
SAP_SE/SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 754
... and 5 more
Published Oct 14, 2025
Tracked Since Feb 18, 2026