CVE-2025-42924

MEDIUM

SAP S/4HANA - Open Redirect

Title source: llm
STIX 2.1

Description

SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be redirected to the page controlled by the attacker. This has low impact on confidentiality and integrity of the application with no impact on availability.

References (2)

Scores

CVSS v3 6.1
EPSS 0.0008
EPSS Percentile 24.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (12)
SAP_SE/SAP S/4HANA landscape (SAP E-Recruiting BSP) 200
SAP_SE/SAP S/4HANA landscape (SAP E-Recruiting BSP) 603
SAP_SE/SAP S/4HANA landscape (SAP E-Recruiting BSP) 604
SAP_SE/SAP S/4HANA landscape (SAP E-Recruiting BSP) 605
SAP_SE/SAP S/4HANA landscape (SAP E-Recruiting BSP) 606
SAP_SE/SAP S/4HANA landscape (SAP E-Recruiting BSP) 616
SAP_SE/SAP S/4HANA landscape (SAP E-Recruiting BSP) 617
SAP_SE/SAP S/4HANA landscape (SAP E-Recruiting BSP) 800
SAP_SE/SAP S/4HANA landscape (SAP E-Recruiting BSP) 801
SAP_SE/SAP S/4HANA landscape (SAP E-Recruiting BSP) 802
... and 2 more
Published Nov 11, 2025
Tracked Since Feb 18, 2026