CVE-2025-0054: Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java

Published Feb 11, 2025

Updated

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.

Affected Software

1 affected component

SAP NetWeaver Application Server Java

Event History

Feb 11, 2025

CVE Published

via MITRE·12:32 AM

Data Sourced

via MITRE·12:32 AM

DescriptionSeverity

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-0054?

CVE-2025-0054 has a high severity rating due to the potential for stored cross-site scripting attacks that could lead to unauthorized actions by users.

How do I fix CVE-2025-0054?

To mitigate CVE-2025-0054, apply the latest patches and updates provided by SAP for the NetWeaver Application Server Java.

What types of systems are affected by CVE-2025-0054?

CVE-2025-0054 affects the SAP NetWeaver Application Server Java and can impact any deployed instance.

Who can exploit CVE-2025-0054?

CVE-2025-0054 can be exploited by attackers with basic user privileges who can store malicious JavaScript payloads.

What are the consequences of an exploit of CVE-2025-0054?

Exploitation of CVE-2025-0054 can allow attackers to execute arbitrary JavaScript in the context of victim users, potentially leading to data theft or session hijacking.