VulnerabilityDeferred

CVE-2025-0057

SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability.

MEDIUM 4.8EPSS 0.24%

Does this matter?

Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.

Description

SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of victim's web browser.

CVSS 3.1: 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.24% probability · 15th percentile
CISA KEV: Not listed
Weakness: CWE-434
Source: cna@sap.com

References

https://me.sap.com/notes/3514421
https://url.sap/sapsecuritypatchday

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.