CVE-2025-42893: Open Redirect vulnerability in SAP Business Connector

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-11 · updated 2026-10-18
Weakness: CWE-601

Description

Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site displayed within an embedded frame. Successful exploitation could allow the attacker to steal sensitive information and perform unauthorized actions, impacting the confidentiality and integrity of web client data. There is no impact to system availability resulting from this vulnerability.

Affected products

SAP_SE SAP Business Connector: 4.8

References

https://me.sap.com/notes/3662000
https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42893 or the next vulnerability affects your stack