CVE-2025-42990: HTML Injection in Unprotected SAPUI5 applications
Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled URL. This issue could impact the integrity of the application. Confidentiality or Availability are not impacted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-42990?
CVE-2025-42990 is considered a high severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2025-42990?
To mitigate CVE-2025-42990, ensure that proper input validation and output encoding are implemented in your SAPUI5 applications.
Who is affected by CVE-2025-42990?
CVE-2025-42990 affects all versions of SAPUI5 applications that do not implement adequate security controls against script injections.
What are the potential impacts of CVE-2025-42990?
The potential impacts of CVE-2025-42990 include unauthorized redirection of users and compromise of application integrity.
Is there a patch available for CVE-2025-42990?
As of now, there is no specific patch listed for CVE-2025-42990, but updates to SAP software should be monitored for any security fixes.