CVE-2025-42920: SAP Supplier Relationship Management XSS

CVE-2025-42920 Overview

CVE-2025-42920 is a Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (SRM) 7.0. An unauthenticated attacker can craft a malicious link and distribute it publicly. When an authenticated victim clicks the link, injected input is processed during page generation, causing the browser to execute attacker-controlled content. The execution occurs within the victim's browser scope and allows the attacker to read and modify session data. Confidentiality and integrity are affected, while availability is not impacted. The flaw is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An unauthenticated attacker can hijack authenticated SAP SRM sessions through a crafted link, exposing procurement data and enabling unauthorized modifications within the victim's browser context.

Affected Products

SAP Supplier Relationship Management 7.0
Deployments exposing SRM web interfaces to internet-reachable users
Environments where SRM users authenticate via browser sessions

Discovery Timeline

2025-09-09 - CVE-2025-42920 published to NVD
2025-09-09 - SAP publishes SAP Note #3647098 on Security Patch Day
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42920

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the SAP SRM 7.0 web interface. User-controlled input from a URL parameter is embedded in the server-rendered HTML response without adequate output encoding or sanitization. When the victim's browser renders the response, the injected payload executes in the same origin as SAP SRM.

The attack requires user interaction because the victim must click the crafted link. However, no privileges are required from the attacker to generate and distribute the link. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component's security context. This is characteristic of reflected XSS where the payload executes in the authenticated user's session context.

Because SAP SRM handles procurement workflows, sourcing, and supplier data, successful exploitation can expose sensitive business information and allow unauthorized actions performed as the victim.

Root Cause

The root cause is improper neutralization of user input during web page generation [CWE-79]. Input reflected in the HTTP response is not context-appropriately encoded before being written to the HTML, JavaScript, or attribute contexts, allowing script injection.

Attack Vector

The attack is network-based and requires victim interaction. An attacker crafts a URL containing an XSS payload targeting a vulnerable SRM endpoint and delivers it via email, chat, forum posts, or any public channel. When an authenticated SRM user clicks the link, the payload executes in their browser, gaining access to session cookies, DOM data, and the ability to issue authenticated requests to SRM on behalf of the victim.

No public exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.242%.

See the SAP Note #3647098 for vendor-specific technical details.

Detection Methods for CVE-2025-42920

Indicators of Compromise

Inbound HTTP requests to SAP SRM URLs containing script tags, javascript: URIs, event handlers such as onerror= or onload=, or HTML-encoded equivalents in query parameters
Referrer headers from external chat, email, or social platforms preceding suspicious SRM requests
Web server logs showing unusually long or encoded query strings targeting SRM reporting or search endpoints
Browser telemetry showing unexpected outbound requests from SRM origin to attacker-controlled domains

Detection Strategies

Deploy Web Application Firewall (WAF) rules to identify reflected XSS payload patterns in SRM traffic
Inspect SAP HTTP server access logs for encoded script fragments and unusual URL parameter values
Correlate SRM access logs with proxy or email gateway logs to detect users arriving from external redirectors
Alert on authenticated SRM sessions performing atypical write operations shortly after clicking an inbound link

Monitoring Recommendations

Enable and centralize SAP Web Dispatcher and NetWeaver AS ABAP HTTP logs for continuous review
Monitor Content Security Policy (CSP) violation reports if CSP is enforced on SRM responses
Track user-agent, source IP, and geolocation anomalies for SRM sessions performing procurement actions
Establish a baseline of normal SRM URL parameters and alert on deviations

How to Mitigate CVE-2025-42920

Immediate Actions Required

Apply the SAP-provided fix referenced in SAP Note #3647098 as soon as change control permits
Restrict SAP SRM web interface exposure to trusted networks or VPN-only access where operationally feasible
Educate SRM users on the risk of clicking links to SRM URLs received from untrusted sources
Enforce short SAP session timeouts and require re-authentication for privileged procurement actions

Patch Information

SAP released the fix through SAP Security Patch Day. Administrators must download and apply SAP Note #3647098 to affected SRM 7.0 systems. Follow the note's implementation instructions, including any prerequisite support packages, and test in a non-production environment before deploying to production.

Workarounds

Deploy a WAF or reverse proxy rule set to filter script injection patterns targeting SRM endpoints until the patch is applied
Enforce a strict Content Security Policy on SRM responses to reduce the impact of injected scripts
Set HttpOnly and Secure flags on SAP session cookies to limit script access to session tokens
Disable or restrict access to non-essential SRM endpoints that reflect user input in responses

bash

# Example WAF rule concept (ModSecurity) to block reflected XSS patterns on SRM URIs
SecRule REQUEST_URI "@beginsWith /sap/bc/srm" \
  "chain,phase:2,deny,status:403,id:1004292,msg:'Potential XSS targeting SAP SRM (CVE-2025-42920)'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror\s*=|onload\s*=|<svg|<iframe)" "t:none,t:urlDecodeUni"