Critical · published May 13, 2025
CVSS calls it critical at 9.1. It is confirmed in active exploitation. It sits in the 96.3th percentile for exploit probability.
🚨 A privileged user can upload untrusted metadata, leading to a potential compromise of your entire SAP system! 🔥 Think of it like a VIP event where a known person hands over a mysterious package at the entrance, bypassing all security checks. Once inside, that package can unleash chaos, impacting everything from your guest list to the event’s very success! If exploited, an attacker could gain unauthorized access to sensitive data, alter configurations, or even crash the system entirely! This vulnerability isn't just a minor inconvenience; it poses an absolutely devastating risk to your operations and data integrity.
Think of it like a VIP event where a known person hands over a mysterious package at the entrance, bypassing all security checks. Once inside, that package can unleash chaos, impacting everything from your guest list to the event’s very success! CVE-2025-42999 allows a privileged user to upload malicious content that, upon deserialization, can execute arbitrary code and compromise the host system's confidentiality, integrity, and availability.
If exploited, an attacker could gain unauthorized access to sensitive data, alter configurations, or even crash the system entirely! This vulnerability isn't just a minor inconvenience; it poses an absolutely devastating risk to your operations and data integrity. To tackle this issue, promptly patch your SAP NetWeaver Visual Composer to the latest version. Ensure that you implement strict validation checks on uploaded content to prevent malicious data from being processed. Regular audits of user permissions and upload procedures are also recommended. You've got this! With these steps, you'll be on your way to securing your SAP environment in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| sap/netweaver | all versions | — |