CVE-2025-42909

LOW

SAP Cloud Appliance Library Appliances - Sensitive Cookie Without 'HttpOnly' Flag

Title source: llm
STIX 2.1

Description

SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in an existing SAP CAL appliances to gain access to other appliances. This has low impact on confidentiality of the application, integrity and availability is not impacted.

References (2)

Core 2
Core References

Scores

CVSS v3 3.0
EPSS 0.0002
EPSS Percentile 7.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-1004
Status published
Products (1)
SAP_SE/SAP Cloud Appliance Library Appliances TITANIUM_WEBAPP 4.0
Published Oct 14, 2025
Tracked Since Feb 18, 2026