SAP Application Server CVE-2025-42901

Exploitation requires (1) a valid authenticated SAP application account with sufficient rights to submit/store content via the BAPI Explorer (PR:L), and (2) a second victim user subsequently opening the affected BAPI Explorer functionality where the stored payload renders and executes in their browser. The dependence on prior authentication and on victim interaction with a specific, developer/administrator-oriented tool (BAPI Explorer) materially limits real-world exploitation; this is not a default-exposed, unauthenticated internet-facing surface. Impact is confined to the victim's browser session (low confidentiality and integrity, no availability).

This is a stored (persistent) cross-site scripting issue in the BAPI Explorer of SAP Application Server for ABAP, and the signals consistently point to a moderate, not critical, priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 5.4 Medium) requires an authenticated attacker (PR:L) and yields only low confidentiality and low integrity impact with no availability impact. EPSS is low at 0.23% (12th percentile), indicating a low modeled probability of exploitation in the near term, and there is no CISA KEV listing and no public exploit identified - so there is no public exploit identified at time of analysis. One conflict should be noted explicitly: the input CVSS sets UI:N, yet the description says the payload 'could be executed in victim user's browser when accessing the affected functionality,' which is the textbook pattern of victim-side user interaction (UI:R) - verify the UI metric with SAP. A second mismatch: the CWE is CWE-94 (Code Injection) and the input tags include 'RCE,' but the described behavior and the low C:L/I:L/A:N impacts are consistent with browser-context XSS, not server-side remote code execution; treating this as RCE would overstate the risk. Net assessment: a real but lower-tier issue - patch in the normal SAP Security Patch Day cycle rather than as an emergency, with priority raised where the BAPI Explorer is exposed to many interactive users.

An attacker with valid but low-privileged SAP application credentials stores a malicious JavaScript payload through the BAPI Explorer. When another user - potentially a more privileged administrator or developer - later opens the affected BAPI Explorer functionality, the stored script executes in their authenticated browser session, enabling session-context actions such as reading displayed data or issuing requests as that user. No public exploit code is identified, and the network attack vector is offset by the requirement for prior authentication and for a victim to view the stored content.