CVE-2025-42884— JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal
Quick assessment
Affected
SAP_SE SAP NetWeaver Enterprise Portal
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP NetWeaver Enterprise Portal是德国思爱普（SAP）公司的一个 SAP NetWeaver的 Web 前端组件。 SAP NetWeaver Enterprise Portal存在安全漏洞，该漏洞源于未经验证的攻击者可注入JNDI环境属性或传递JNDI查找操作期间使用的URL，可能导致信息泄露或修改。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-42884
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal
Source: CVE Program / CVE List V5
Vulnerability Description
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: CVE Program / CVE List V5
Vulnerability Title
SAP NetWeaver Enterprise Portal 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP NetWeaver Enterprise Portal是德国思爱普（SAP）公司的一个 SAP NetWeaver的 Web 前端组件。 SAP NetWeaver Enterprise Portal存在安全漏洞，该漏洞源于未经验证的攻击者可注入JNDI环境属性或传递JNDI查找操作期间使用的URL，可能导致信息泄露或修改。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP NetWeaver Enterprise Portal | EP-BASIS 7.50 | - |
|
II. Public POCs for CVE-2025-42884
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-42884
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2025-11-11 · 18 CVEs total
| CVE-2025-42890 | 10.0 CRITICAL | Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui) |
| CVE-2025-42887 | 9.9 CRITICAL | Code Injection vulnerability in SAP Solution Manager |
| CVE-2025-42940 | 7.5 HIGH | Memory Corruption vulnerability in SAP CommonCryptoLib |
| CVE-2025-42895 | 6.9 MEDIUM | Code Injection vulnerability in SAP HANA JDBC Client |
| CVE-2025-42894 | 6.8 MEDIUM | Path Traversal vulnerability in SAP Business Connector |
| CVE-2025-42892 | 6.8 MEDIUM | OS Command Injection vulnerability in SAP Business Connector |
| CVE-2025-42924 | 6.1 MEDIUM | Open Redirect vulnerabilities in SAP S/4HANA landscape (SAP E-Recruiting BSP) |
| CVE-2025-42886 | 6.1 MEDIUM | Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector |
| CVE-2025-42893 | 6.1 MEDIUM | Open Redirect vulnerability in SAP Business Connector |
| CVE-2025-42885 | 5.8 MEDIUM | Missing authentication in SAP HANA 2.0 (hdbrss) |
| CVE-2025-42888 | 5.5 MEDIUM | Information Disclosure vulnerability in SAP GUI for Windows |
| CVE-2025-42889 | 5.4 MEDIUM | SQL Injection vulnerability in SAP Starter Solution (PL SAFT) |
| CVE-2025-42897 | 5.3 MEDIUM | Information Disclosure vulnerability in SAP Business One (SLD) |
| CVE-2025-42919 | 5.3 MEDIUM | Information Disclosure vulnerability in SAP NetWeaver Application Server Java |
| CVE-2025-42899 | 4.3 MEDIUM | Missing Authorization check in SAP S4CORE (Manage Journal Entries) |
| CVE-2025-42882 | 4.3 MEDIUM | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2025-42883 | 2.7 LOW | Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migra |
IV. Related Vulnerabilities
Same product: SAP NetWeaver Enterprise Portal
-
CVE-2026-44759
Cross Site Scripting (XSS) vulnerability in SAP NetWeaver En -
CVE-2026-0499
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En -
CVE-2025-42872
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En -
CVE-2024-44120
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En -
CVE-2023-33985
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-943
-
CVE-2026-73976
djehuty: Unauthenticated SPARQL injection in the search API -
CVE-2026-73975
djehuty: Authenticated SPARQL injection in session editing a -
CVE-2026-103289
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments -
CVE-2026-103258
n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via -
CVE-2026-103250
n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via
V. Comments for CVE-2025-42884
No comments yet