Vulnerability · Published Nov 11, 2025 · Assigned by sap

CVE-2025-42919Information Disclosure vulnerability in SAP NetWeaver Application Server Java

Medium 5.3

In plain English

A medium-severity path traversal in SAP NetWeaver Application Server Java from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 57.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access to sensitive application metadata. This results in a partial compromise of the confidentiality of the information without affecting the integrity or availability of the application server.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP NetWeaver Application Server Java	ENGINEAPI 7.50EP-BASIS 7.50

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References