SAP NetWeaver AS ABAP Multiple Vulnerabilities (August 2025)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(250286);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/08/15");

  script_cve_id(
    "CVE-2025-42936",
    "CVE-2025-42942"
  );
  script_xref(name:"IAVA", value:"2025-A-0607");

  script_name(english:"SAP NetWeaver AS ABAP Multiple Vulnerabilities (August 2025)");

  script_set_attribute(attribute:"synopsis", value:
"The remote SAP NetWeaver ABAP server may be affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote SAP NetWeaver ABAP server may be affected by multiple vulnerabilies.

  - The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished
  authorizations for different user roles, this issue allows authenticated users to access restricted objects
  in the barcode interface, leading to privilege escalation. This results in a low impact on the
  confidentiality and integrity of the application, there is no impact on availability. (CVE-2025-42936)
  
  - SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an
  unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated
  victim to click on it to execute the script. Upon successful exploitation, the attacker could access and
  modify limited information within the scope of victim's browser. This vulnerability has no impact on
  availability of the application. (CVE-2025-42942)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2025.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2d9e7a65");
  script_set_attribute(attribute:"see_also", value:"https://me.sap.com/notes/3597355");
  script_set_attribute(attribute:"see_also", value:"https://me.sap.com/notes/3602656");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-42942");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/15");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:sap:netweaver_application_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("sap_netweaver_as_web_detect.nbin");
  script_require_keys("installed_sw/SAP Netweaver Application Server (AS)", "Settings/ParanoidReport");
  script_require_ports("Services/www", 80, 443, 8000, 50000);

  exit(0);
}

include('vcf_extras_sap.inc');

var app_info = vcf::sap_netweaver_as::get_app_info();

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var constraints = [
  {'min_version':'700', 'max_version':'702', 'fixed_display':'See vendor advisory'},
  {'equal':'731', 'fixed_display':'See vendor advisory'},
  {'equal':'740', 'fixed_display':'See vendor advisory'},
  {'min_version':'750', 'max_version':'815', 'fixed_display':'See vendor advisory'},
  {'equal':'816', 'fixed_display':'See vendor advisory'},	
  {'equal':'914', 'fixed_display':'See vendor advisory'},	
  {'equal':'916', 'fixed_display':'See vendor advisory'}
];

vcf::sap_netweaver_as::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE,
  abap:true,
  flags:{xss:true}
);