CVE-2025-42990

Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled URL. This issue could impact the integrity of the application. Confidentiality or Availability are not impacted.

Score

CVSS 3.1 3.0 Low

Status

Deferred - cna@sap.com

Published

2025-06-10

Last modified

2025-06-10

Weaknesses

CWE-79

Affected products

• Sapui5 Applications (Sap Se)

References

• https://me.sap.com/notes/3601169
• https://url.sap/sapsecuritypatchday