CVE-2025-42909CWE-1004

CVE-2025-42909

Low · published October 14, 2025

CVSS v3.1
3.0
EPSS
0%
Percentile
14.5
In the wild
Unconfirmed
What it is

SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in an existing SAP CAL appliances to gain access to other appliances. This has low impact on confidentiality of the application, integrity and availability is not impacted.

The record
Technical detail
CVSS v3.1
3.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00242 · 14.5th percentile
Weakness
CWE-1004 · Sensitive Cookie Without 'HttpOnly' Flag
Published
2025-10-14T05:15Z
References (2)
https://me.sap.com/notes/3643871 · [email protected]https://url.sap/sapsecuritypatchday · [email protected]
EPSS history
Timeline
  • 14 OCT 00:18Z
    Security Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances
    cvelistv5