CVE-2025-42941: Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad)
SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link (<a>) elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pages. While administrative access is necessary for certain configurations, the attacker does not need the administrative privileges to execute the attack. This could result in unintended manipulation of user sessions or exposure of sensitive information. The issue impacts the confidentiality and integrity of the system, but the availability remains unaffected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-42941?
CVE-2025-42941 is classified as a critical vulnerability due to the potential for an attacker to exploit the Reverse Tabnabbing flaw.
How do I fix CVE-2025-42941?
To mitigate CVE-2025-42941, ensure that input validations are applied to external links and implement adequate security measures for link navigation.
Who is affected by CVE-2025-42941?
CVE-2025-42941 affects SAP Fiori (Launchpad) users, particularly those with administrative privileges.
Can CVE-2025-42941 be exploited remotely?
Yes, CVE-2025-42941 can be exploited remotely if an attacker can trick an authenticated user into clicking a malicious link.
What are the risks of not addressing CVE-2025-42941?
Failing to address CVE-2025-42941 could lead to unauthorized actions on behalf of administrative users and potential data exposure.