CVE-2025-42884: sap_se sap netweaver enterprise portal

Vulnerability summary

CVE-2025-42884 is a medium (CVSS 6.5) vulnerability in sap_se sap netweaver enterprise portal. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 18.9% of scored vulnerabilities.

Timeline

1. 11-11-2025
   PublishedVulnerability first disclosed.
2. 12-11-2025
   Last modifiedVulnerability information updated.

Description

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availability.

• CWE-943Improper Neutralization of Special Elements in Data Query LogicThe product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.