CVE-2025-0054CWE-79

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java

Medium · published February 11, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
18.8
In the wild
Unconfirmed
What it is

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00274 · 18.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-02-11T00:32Z
EPSS history
Timeline
  • 11 FEB 00:32Z
    Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java
    cvelistv5