CVE-2025-42884

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availability.

Score
CVSS 3.1 6.5 Medium
Status
Deferred - cna@sap.com
Published
2025-11-11
Last modified
2026-10-18
Weaknesses
CWE-943

Affected products

References

 
 
© AVABIS GmbH privacypolicy about