CVE-2025-42962: SAP Business Warehouse XSS Vulnerability

CVE-2025-42962 Overview

CVE-2025-42962 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting SAP Business Warehouse Business Explorer Web. An attacker can craft a malicious link that, when clicked by an authenticated user, executes injected script within the victim's browser context. Successful exploitation impacts confidentiality and integrity of the affected session but does not affect availability. The flaw requires user interaction and no attacker privileges, making phishing and social engineering plausible delivery methods against SAP business users.

Critical Impact
Authenticated user sessions in SAP Business Warehouse can be compromised through malicious links, enabling session data theft and unauthorized actions in the victim's browser.

Affected Products

SAP Business Warehouse (Business Explorer Web)
SAP BW installations exposing Business Explorer Web interfaces
Deployments referenced in SAP Note 3604212

Discovery Timeline

2025-07-08 - CVE-2025-42962 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42962

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting flaw classified under [CWE-79]. Business Explorer Web fails to properly neutralize user-controllable input before it is reflected back into the HTTP response served to the browser. An attacker constructs a URL containing script payloads targeting the vulnerable parameter. When an authenticated SAP BW user follows the link, the browser renders the response and executes the injected JavaScript in the trusted origin of the SAP application.

Because the CVSS scope is changed, the injected script can access resources beyond the immediate vulnerable component. Confidentiality and integrity impacts stem from the ability to read session tokens, exfiltrate report data, or issue authenticated requests on behalf of the victim. Availability remains unaffected because the payload does not disrupt server-side processing.

Root Cause

The root cause is missing or insufficient output encoding in Business Explorer Web response handlers. User-supplied parameters are inserted into HTML or JavaScript contexts without contextual escaping, allowing attacker markup to break out of the intended data context and execute as code.

Attack Vector

Exploitation requires an authenticated victim to click a malicious link delivered through email, chat, or a compromised web page. No attacker authentication is needed to craft the payload. The attacker hosts or distributes a URL pointing to the vulnerable Business Explorer Web endpoint with an embedded script payload. On click, the payload runs in the victim's browser under the SAP BW origin. Attackers commonly use this class of flaw to steal session cookies, hijack SAP sessions, submit forged requests to backend transactions, or pivot to further application abuse. See the SAP Note #3604212 for vendor technical details.

Detection Methods for CVE-2025-42962

Indicators of Compromise

HTTP request logs containing suspicious query parameters with <script>, javascript:, onerror=, or URL-encoded equivalents targeting Business Explorer Web URLs
Referer headers from external domains preceding sensitive SAP BW report actions
Unusual outbound requests from user browsers to attacker-controlled domains immediately after accessing BW URLs
Session anomalies such as concurrent logins or actions initiated from unexpected geographies for authenticated BW users

Detection Strategies

Enable verbose HTTP access logging on SAP Web Dispatcher and NetWeaver front-ends and inspect for script-like tokens in query strings and POST bodies
Deploy a Web Application Firewall (WAF) with XSS rulesets tuned for SAP BW URL patterns
Correlate SAP audit logs with proxy and endpoint telemetry to identify reflected payload delivery followed by authenticated actions

Monitoring Recommendations

Alert on HTTP responses that echo request parameters containing HTML or JavaScript metacharacters
Monitor phishing reports and email gateway telemetry for links pointing to SAP BW hosts with encoded script content
Track browser Content Security Policy (CSP) violation reports from BW application origins for early indication of injection attempts

How to Mitigate CVE-2025-42962

Immediate Actions Required

Apply the SAP-provided patch referenced in SAP Note #3604212 to affected Business Warehouse systems
Review the SAP Security Patch Day bulletin and identify all in-scope BW landscapes
Notify BW end users about phishing risk and instruct them not to click unsolicited links referencing BW report URLs

Patch Information

SAP has released a security fix documented in SAP Note 3604212. Administrators should authenticate to the SAP Support Portal, download the applicable support package or note correction, and apply it to all Business Warehouse systems running Business Explorer Web. Validate the fix in non-production first and confirm resolution through regression testing of BW reporting workflows.

Workarounds

Restrict access to Business Explorer Web endpoints to trusted network segments using SAP Web Dispatcher or reverse proxy rules until patching is complete
Enforce a strict Content Security Policy (CSP) on BW responses to block inline script execution and unauthorized script sources
Enable HttpOnly and Secure flags on SAP session cookies to limit script-based session theft
Deploy WAF signatures that block reflected XSS payloads targeting BW URL patterns

bash

# Example WAF rule concept for blocking reflected XSS on BW endpoints
# Adapt to your WAF syntax (ModSecurity example)
SecRule REQUEST_URI "@contains /sap/bw/" \
  "chain,phase:2,deny,status:403,id:1004296,msg:'Potential XSS targeting SAP BW Business Explorer Web'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" "t:none,t:urlDecodeUni"