CVE-2025-42904
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-09

Last updated on: 2025-12-09

Assigner: SAP SE

Description
Due to an Information Disclosure vulnerability in Application Server ABAP, an authenticated attacker could read unmasked values displayed in ABAP Lists. Successful exploitation could lead to unauthorized disclosure of data, resulting in a high impact on confidentiality without affecting integrity or availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-12-09
Last Modified
2025-12-09
Generated
2026-07-06
AI Q&A
2025-12-09
EPSS Evaluated
2026-07-05
NVD
CVE-2025-42904
EUVD
EUVD-2025-201845

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap application_server_abap 3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-549 The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Information Disclosure issue in the Application Server ABAP. An authenticated attacker can read unmasked values displayed in ABAP Lists, which means sensitive data that should be protected can be accessed without proper masking.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive data, impacting the confidentiality of information. However, it does not affect the integrity or availability of the system.

Compliance Impact

This vulnerability leads to unauthorized disclosure of data, which could negatively impact compliance with data protection standards and regulations such as GDPR and HIPAA that require safeguarding confidentiality of personal and sensitive information.

Mitigation Strategies

Apply the latest SAP Security Notes and patches related to Application Server ABAP as provided by SAP. Regularly monitor SAP Security Notes & News for updates and follow SAP's recommended security patching procedures to mitigate this vulnerability. [1]

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-42904. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart