The vulnerability of the SAP NetWeaver Enterprise Portal (SAP NW EP) software integration platform lies in the improper elimination of special elements in data queries, allowing an attacker to gain access to read and modify data.

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform SAP NW EP is related to improper elimination of special elements in data requests. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read and modify data...

The vulnerability of the SAP NetWeaver software integration platform, related to errors in privilege management, allows a perpetrator to gain access to read, modify, and delete confidential data.

The vulnerability of the SAP NetWeaver software integration platform is related to errors in privilege management. Exploiting this vulnerability can allow an attacker, operating remotely, to gain read, modify, or delete access to confidential data...

The vulnerability of SAP NetWeaver AS Java software integration platforms, related to improper code generation management, allows attackers to load any arbitrary file.

The vulnerability of SAP NetWeaver AS Java software-based integration platforms is related to incorrect code generation management. Exploiting this vulnerability allows a malicious actor to download any arbitrary file remotely...

SAP NetWeaver AS Java Information Disclosure (3643603)

The version of SAP NetWeaver Application Server Java installed on the remote host is affected by an information disclosure vulnerability. Due to improper limitation of a pathname to a restricted directory, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker...

SAP NetWeaver AS ABAP Missing Authorization Check (3643337)

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system...

CVE-2025-42884

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There i...

CVE-2025-42883

Migration Workbench DX Workbench in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges uploads files to the application server. An attacker could leverage this and upload a malicious file into the system. This results in a low...

CVE-2025-42882

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system...

CVE-2025-42919

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in several products, including SAP NetWeaver, SAP Business Connector, SAP HANA, and SAP S/4HANA. The vulnerabilities include deserialization, code injection, insufficient validation, and information disclosure. These vulnerabilities can be exploited by attackers to...

EUVD-2025-60994

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There i...

EUVD-2025-60981

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access...

CVE-2025-42919

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access...

CVE-2025-42883

Migration Workbench DX Workbench in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges uploads files to the application server. An attacker could leverage this and upload a malicious file into the system. This results in a low...

CVE-2025-42882

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system...

CVE-2025-42919 Information Disclosure vulnerability in SAP NetWeaver Application Server Java

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access...

CVE-2025-42919 Information Disclosure vulnerability in SAP NetWeaver Application Server Java

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access...

CVE-2025-42919

CVE-2025-42919 affects the SAP NetWeaver Application Server Java. The vulnerability is an information disclosure caused by improper restriction of path components, allowing an unauthenticated attacker to access internal metadata files by crafting URLs. The impact is partial confidentiality loss; ...

CVE-2025-42884 JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There i...

CVE-2025-42884 JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There i...