CVE-2025-42981: sap_se sap netweaver application server abap Open Redirect

Vulnerability summary

CVE-2025-42981 is a medium (CVSS 6.1) Open Redirect vulnerability in sap_se sap netweaver application server abap. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.5% of scored vulnerabilities.

Timeline

1. 08-07-2025
   PublishedVulnerability first disclosed.
2. 08-07-2025
   Last modifiedVulnerability information updated.

Description

Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script at a location not properly sanitized. When a victim clicks on this link, the script executes within the victim's browser, redirecting them to a site controlled by the attacker. This allows the attacker to access and/or modify restricted information related to the web client. While the vulnerability poses no impact on data availability, it presents a considerable risk to confidentiality and integrity.

• CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.