CVE-2025-42908: Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP
Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allow the attacker to perform actions and execute transactions that would normally require specific permissions, compromising the integrity and confidentiality of the system by enabling unauthorized access to restricted functionality. There is no impact to availability from this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-42908?
CVE-2025-42908 has a high severity rating due to its potential to allow authenticated attackers to initiate unauthorized transactions.
How do I fix CVE-2025-42908?
To mitigate CVE-2025-42908, ensure that all relevant security patches provided by SAP for the NetWeaver Application Server for ABAP are applied.
Who is affected by CVE-2025-42908?
CVE-2025-42908 affects users of SAP NetWeaver Application Server for ABAP who have not implemented the necessary security updates.
What type of vulnerability is CVE-2025-42908?
CVE-2025-42908 is categorized as a Cross-Site Request Forgery (CSRF) vulnerability.
Can CVE-2025-42908 be exploited remotely?
Yes, CVE-2025-42908 can be exploited remotely by an authenticated attacker to bypass authorization checks.