Vulnerability-Lookup

CVE-2025-42878 (GCVE-0-2025-42878)

Vulnerability from cvelistv5 – Published: 2025-12-09 02:14 – Updated: 2025-12-09 16:39

Title

Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM)

Summary

SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-09 16:39 UTC

CWE

CWE-1244 - Internal Asset Exposed to Unsafe Debug Access Level or State

Assigner

sap CNA under the mitre root

CNA scorecard C 65/100 over 117 records in the last 180 days details

References

2 references

URL	Tags
https://me.sap.com/notes/3684682
https://url.sap/sapsecuritypatchday

Impacted products

1 product

Vendor	Product	Version	CPE status
SAP_SE	SAP Web Dispatcher and Internet Communication Manager (ICM)	Affected: KRNL64NUC 7.22 Affected: 7.22EXT Affected: KRNL64UC 7.22 Affected: 7.53 Affected: WEBDISP 7.22_EXT Affected: 7.54 Affected: 7.77 Affected: 7.89 Affected: 7.93 Affected: 9.16 Affected: KERNEL 7.22	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-42878",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-09T16:39:22.251146Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-09T16:39:27.411Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Web Dispatcher and Internet Communication Manager (ICM)",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22"
            },
            {
              "status": "affected",
              "version": "7.22EXT"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.22"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.22_EXT"
            },
            {
              "status": "affected",
              "version": "7.54"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.89"
            },
            {
              "status": "affected",
              "version": "7.93"
            },
            {
              "status": "affected",
              "version": "9.16"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.22"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.\u003c/p\u003e"
            }
          ],
          "value": "SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1244",
              "description": "CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-09T02:14:59.636Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3684682"
        },
        {
          "url": "https://url.sap/sapsecuritypatchday"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM)",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2025-42878",
    "datePublished": "2025-12-09T02:14:59.636Z",
    "dateReserved": "2025-04-16T13:25:17.023Z",
    "dateUpdated": "2025-12-09T16:39:27.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-42878",
      "date": "2026-10-21",
      "epss": "0.00359",
      "percentile": "0.28361"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "SAP Web Dispatcher and Internet Communication Manager (ICM)",
                "vendor": "SAP_SE",
                "versions": [
                  {
                    "status": "affected",
                    "version": "KRNL64NUC 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.22EXT"
                  },
                  {
                    "status": "affected",
                    "version": "KRNL64UC 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.53"
                  },
                  {
                    "status": "affected",
                    "version": "WEBDISP 7.22_EXT"
                  },
                  {
                    "status": "affected",
                    "version": "7.54"
                  },
                  {
                    "status": "affected",
                    "version": "7.77"
                  },
                  {
                    "status": "affected",
                    "version": "7.89"
                  },
                  {
                    "status": "affected",
                    "version": "7.93"
                  },
                  {
                    "status": "affected",
                    "version": "9.16"
                  },
                  {
                    "status": "affected",
                    "version": "KERNEL 7.22"
                  }
                ]
              }
            ],
            "source": "cna@sap.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application."
          },
          {
            "lang": "es",
            "value": "SAP Web Dispatcher e ICM pueden exponer interfaces de prueba internas que no est\u00e1n destinadas a producci\u00f3n. Si est\u00e1n habilitadas, atacantes no autenticados podr\u00edan explotarlas para acceder a diagn\u00f3sticos, enviar solicitudes manipuladas o interrumpir servicios. Esta vulnerabilidad tiene un alto impacto en la confidencialidad, disponibilidad y bajo impacto en la integridad y de la aplicaci\u00f3n."
          }
        ],
        "id": "CVE-2025-42878",
        "lastModified": "2026-10-07T20:10:01.970",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 6.0,
              "source": "cna@sap.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-42878",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-09T16:39:22.251146Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-09T16:17:52.230",
        "references": [
          {
            "source": "cna@sap.com",
            "url": "https://me.sap.com/notes/3684682"
          },
          {
            "source": "cna@sap.com",
            "url": "https://url.sap/sapsecuritypatchday"
          }
        ],
        "sourceIdentifier": "cna@sap.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1244"
              }
            ],
            "source": "cna@sap.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-12-10T02:32:46+00:00",
      "cve": "CVE-2025-42878",
      "id": "CVE-2025-42878",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-42878.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-42878",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-12-09T16:39:22.251146Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-12-09T16:39:24.018Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "SAP Web Dispatcher and Internet Communication Manager (ICM)",
              "vendor": "SAP_SE",
              "versions": [
                {
                  "status": "affected",
                  "version": "KRNL64NUC 7.22"
                },
                {
                  "status": "affected",
                  "version": "7.22EXT"
                },
                {
                  "status": "affected",
                  "version": "KRNL64UC 7.22"
                },
                {
                  "status": "affected",
                  "version": "7.53"
                },
                {
                  "status": "affected",
                  "version": "WEBDISP 7.22_EXT"
                },
                {
                  "status": "affected",
                  "version": "7.54"
                },
                {
                  "status": "affected",
                  "version": "7.77"
                },
                {
                  "status": "affected",
                  "version": "7.89"
                },
                {
                  "status": "affected",
                  "version": "7.93"
                },
                {
                  "status": "affected",
                  "version": "9.16"
                },
                {
                  "status": "affected",
                  "version": "KERNEL 7.22"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eSAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.\u003c/p\u003e"
                }
              ],
              "value": "SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1244",
                  "description": "CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State",
                  "lang": "eng",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-12-09T02:14:59.636Z",
            "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
            "shortName": "sap"
          },
          "references": [
            {
              "url": "https://me.sap.com/notes/3684682"
            },
            {
              "url": "https://url.sap/sapsecuritypatchday"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM)",
          "x_generator": {
            "engine": "Vulnogram 0.5.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "assignerShortName": "sap",
        "cveId": "CVE-2025-42878",
        "datePublished": "2025-12-09T02:14:59.636Z",
        "dateReserved": "2025-04-16T13:25:17.023Z",
        "dateUpdated": "2025-12-09T16:39:27.411Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2025-16275 (CVE-2025-42878)

Vulnerability from fstec – Published: 2025-12-24 – Updated: 2025-12-24 – View on bdu.fstec.ru Fixed

Title

Уязвимость сервера веб-приложений SAP NetWeaver Internet Communication Manager, веб-диспетчера SAP Web Dispatcher, связанная с недостатками механизма присвоения внутреннему ресурсу уровня доступа для отладки, позволяющая нарушителю оказать воздействие на конфиденциальность и доступность защищаемой информации

Summary

Уязвимость сервера веб-приложений SAP NetWeaver Internet Communication Manager, веб-диспетчера SAP Web Dispatcher связана с недостатками механизма присвоения внутреннему ресурсу уровня доступа для отладки. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на конфиденциальность и доступность защищаемой информации

Severity

7.3 (High) CVSS 2.0


                      
                        AV:N/AC:H/Au:N/C:C/I:P/A:C

8.2 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-1244 - Внутренний ресурс, подверженный небезопасному уровню или состоянию доступа к отладке

Aliases

CVE-2025-42878

References

1 reference

URL
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/decemb…

Impacted products

2 products from 1 vendor

Vendors

SAP

Products

SAP NetWeaver Internet Communication Manager, SAP Web Dispatcher

Versions

KRNL64UC 7.22 (SAP NetWeaver Internet Communication Manager), KRNL64UC 7.22EXT (SAP NetWeaver Internet Communication Manager), KRNL64NUC 7.22 (SAP NetWeaver Internet Communication Manager), KRNL64NUC 7.22EXT (SAP NetWeaver Internet Communication Manager), 7.53 (SAP Web Dispatcher), 7.77 (SAP Web Dispatcher), 7.54 (SAP Web Dispatcher), 7.89 (SAP Web Dispatcher), 7.93 (SAP Web Dispatcher), KERNEL 7.22 (SAP Web Dispatcher), KERNEL 7.93 (SAP Web Dispatcher), KRNL64UC 7.53 (SAP NetWeaver Internet Communication Manager), WEBDISP 7.22_EXT (SAP Web Dispatcher), 9.16 (SAP Web Dispatcher), KERNEL 7.53 (SAP Web Dispatcher), KERNEL 7.54 (SAP Web Dispatcher), KERNEL 7.77 (SAP Web Dispatcher), KERNEL 7.89 (SAP Web Dispatcher), KERNEL 9.16 (SAP Web Dispatcher)

Product types

Network software, Network device

Mitigations

Использование рекомендаций производителя: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2025.html

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:H/Au:N/C:C/I:P/A:C",
  "CVSS 3.0": "AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "SAP",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "KRNL64UC 7.22 (SAP NetWeaver Internet Communication Manager), KRNL64UC 7.22EXT (SAP NetWeaver Internet Communication Manager), KRNL64NUC 7.22 (SAP NetWeaver Internet Communication Manager), KRNL64NUC 7.22EXT (SAP NetWeaver Internet Communication Manager), 7.53 (SAP Web Dispatcher), 7.77 (SAP Web Dispatcher), 7.54 (SAP Web Dispatcher), 7.89 (SAP Web Dispatcher), 7.93 (SAP Web Dispatcher), KERNEL 7.22 (SAP Web Dispatcher), KERNEL 7.93 (SAP Web Dispatcher), KRNL64UC 7.53 (SAP NetWeaver Internet Communication Manager), WEBDISP 7.22_EXT (SAP Web Dispatcher), 9.16 (SAP Web Dispatcher), KERNEL 7.53 (SAP Web Dispatcher), KERNEL 7.54 (SAP Web Dispatcher), KERNEL 7.77 (SAP Web Dispatcher), KERNEL 7.89 (SAP Web Dispatcher), KERNEL 9.16 (SAP Web Dispatcher)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2025.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "09.12.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "24.12.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "24.12.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-16275",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-42878",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "SAP NetWeaver Internet Communication Manager, SAP Web Dispatcher",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 SAP NetWeaver Internet Communication Manager, \u0432\u0435\u0431-\u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 SAP Web Dispatcher, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u0438\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u043c\u0443 \u0440\u0435\u0441\u0443\u0440\u0441\u0443 \u0443\u0440\u043e\u0432\u043d\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0434\u043b\u044f \u043e\u0442\u043b\u0430\u0434\u043a\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0412\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 \u0440\u0435\u0441\u0443\u0440\u0441, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0439 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u043c\u0443 \u0443\u0440\u043e\u0432\u043d\u044e \u0438\u043b\u0438 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043e\u0442\u043b\u0430\u0434\u043a\u0435 (CWE-1244)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 SAP NetWeaver Internet Communication Manager, \u0432\u0435\u0431-\u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 SAP Web Dispatcher \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u0438\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u043c\u0443 \u0440\u0435\u0441\u0443\u0440\u0441\u0443 \u0443\u0440\u043e\u0432\u043d\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0434\u043b\u044f \u043e\u0442\u043b\u0430\u0434\u043a\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2025.html",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-1244",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,3)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,2)"
}

CERTFR-2025-AVI-1079

Vulnerability from certfr_avis - Published: 2025-12-09 - Updated: 2025-12-09

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
SAP	SAPUI5 framework	SAPUI5 framework (Markdown-it component) versions SAP_UI 755, 756, 757 et 758 sans le dernier correctif de sécurité
SAP	BusinessObjects	Business Objects versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité
SAP	NetWeaver	NetWeaver Internet Communication Framework versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité
SAP	Web Dispatcher, Internet Communication Manager et Content Server	Web Dispatcher, Internet Communication Manager et Content Server versions KRNL64UC 7.53, WEBDISP 7.53, 7.54, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, CONTSERV 7.53, 7.54, KERNEL 7.53 et 7.54 sans le dernier correctif de sécurité
SAP	jConnect	jConnect - SDK for ASE versions SYBASE_SOFTWARE_DEVELOPER_KIT 16.0.4 et 16.1 sans le dernier correctif de sécurité
SAP	NetWeaver Enterprise Portal	NetWeaver Enterprise Portal version EP-RUNTIME 7.50 sans le dernier correctif de sécurité
SAP	Enterprise Search pour ABAP	Enterprise Search pour ABAP versions SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de sécurité
SAP	Web Dispatcher et Internet Communication Manager (ICM)	Web Dispatcher et Internet Communication Manager (ICM) versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.22_EXT, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93 et 9.16 sans le dernier correctif de sécurité
SAP	S/4HANA	S/4 HANA Private Cloud (Financials General Ledger) versions S4CORE 104, 105, 106, 107, 108 et 109 sans le dernier correctif de sécurité
SAP	NetWeaver	NetWeaver (remote service for Xcelsius) versions BI-BASE-E 7.50, BI-BASE-B 7.50, BI-IBC 7.50, BI-BASE-S 7.50 et BIWEBAPP 7.50 sans le dernier correctif de sécurité
SAP	Commerce Cloud	Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et COM_CLOUD 2211-JDK21 sans le dernier correctif de sécurité
SAP	Business Objects Business Intelligence Platform	Business Objects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de sécurité
SAP	Solution Manager	Solution Manager version ST 720 sans le dernier correctif de sécurité
SAP	Application Server ABAP	Application Server ABAP versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.16 et 9.17 sans le dernier correctif de sécurité

References

Title

Publication Time

FKIE_CVE-2025-42878

Vulnerability from fkie_nvd - Published: 2025-12-09 16:17 - Updated: 2026-10-07 20:10

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H

Summary

References

	URL	Tags
	cna@sap.com	https://me.sap.com/notes/3684682
	cna@sap.com	https://url.sap/sapsecuritypatchday

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Web Dispatcher and Internet Communication Manager (ICM)",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22"
            },
            {
              "status": "affected",
              "version": "7.22EXT"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.22"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.22_EXT"
            },
            {
              "status": "affected",
              "version": "7.54"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.89"
            },
            {
              "status": "affected",
              "version": "7.93"
            },
            {
              "status": "affected",
              "version": "9.16"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.22"
            }
          ]
        }
      ],
      "source": "cna@sap.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application."
    },
    {
      "lang": "es",
      "value": "SAP Web Dispatcher e ICM pueden exponer interfaces de prueba internas que no est\u00e1n destinadas a producci\u00f3n. Si est\u00e1n habilitadas, atacantes no autenticados podr\u00edan explotarlas para acceder a diagn\u00f3sticos, enviar solicitudes manipuladas o interrumpir servicios. Esta vulnerabilidad tiene un alto impacto en la confidencialidad, disponibilidad y bajo impacto en la integridad y de la aplicaci\u00f3n."
    }
  ],
  "id": "CVE-2025-42878",
  "lastModified": "2026-10-07T20:10:01.970",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 6.0,
        "source": "cna@sap.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-42878",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-09T16:39:22.251146Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-09T16:17:52.230",
  "references": [
    {
      "source": "cna@sap.com",
      "url": "https://me.sap.com/notes/3684682"
    },
    {
      "source": "cna@sap.com",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1244"
        }
      ],
      "source": "cna@sap.com",
      "type": "Secondary"
    }
  ]
}

GHSA-549V-R8J8-4RMH

Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2025-12-09 18:30

Details

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-42878"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1244"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-09T16:17:52Z",
    "severity": "HIGH"
  },
  "details": "SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.",
  "id": "GHSA-549v-r8j8-4rmh",
  "modified": "2025-12-09T18:30:37Z",
  "published": "2025-12-09T18:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42878"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3684682"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2025-0395

Vulnerability from csaf_ncscnl - Published: 2025-12-12 09:29 - Updated: 2025-12-12 09:29

Summary

Kwetsbaarheden verholpen in SAP Software

Scope

14 vulnerabilities in this advisory, including CVE-2025-42878.

CVE-2025-42878

SAP Web Dispatcher and ICM have vulnerabilities that could allow unauthenticated attackers to exploit internal testing interfaces, leading to potential sensitive data exposure and risks to application confidentiality and availability.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H

Known affected: 11 products

Open the full advisory

WID-SEC-W-2025-2768

Vulnerability from csaf_certbund - Published: 2025-12-08 23:00 - Updated: 2025-12-08 23:00

Summary

SAP Patchday Dezember 2025: Mehrere Schwachstellen

Severity

Kritisch

Scope

15 vulnerabilities in this advisory, including CVE-2025-42878.

CVE-2025-42878

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-42878 (GCVE-0-2025-42878)

BDU:2025-16275 (CVE-2025-42878)

CERTFR-2025-AVI-1079

Solutions

FKIE_CVE-2025-42878

GHSA-549V-R8J8-4RMH

NCSC-2025-0395

WID-SEC-W-2025-2768

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour