Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser)_CVE-2025-42901

{
    "lastseen": "",
    "description": "SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affected functionality of BAPI explorer. This has low impact on confidentiality and integrity with no impact on availability of the application.",
    "published": "2025-10-14T00:17:23.355Z",
    "modified": "2025-10-14T00:17:23.355Z",
    "type": "cve",
    "title": "Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser)",
    "source": "sap",
    "references": "https://me.sap.com/notes/3652788\nhttps://url.sap/sapsecuritypatchday",
    "id": "CVE-2025-42901",
    "bulletinFamily": "",
    "cwe": [
        "CWE-94"
    ],
    "cvelist": null,
    "sourceData": "SAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 700\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 701\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 702\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 731\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 740\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 750\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 751\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 752\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 753\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 754\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 755\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 756\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 757\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 758\nSAP_SE SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 816",
    "sourceHref": "",
    "cvss": {
        "score": 5.4,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "SAP Application Server for ABAP (BAPI Browser)",
    "version": "SAP_BASIS 700",
    "vendor": "SAP_SE",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}