SAP NetWeaver ABAP CVE-2025-42904

Exploitation requires (1) a valid authenticated SAP session on Application Server ABAP with at least low privileges (CVSS PR:L), and (2) access to an ABAP List output that renders fields which are supposed to be masked - the vulnerability is a failure to mask values in ABAP List display (CWE-549, exposure of information through sensitive data display). Limiting factors: the attacker cannot be fully unauthenticated (no anonymous network exploitation), no administrative privileges are needed, and the exposure is bounded to data actually shown in ABAP Lists the user can reach, so impact scales with what sensitive fields a given customer's reports display. No user interaction by a victim is required.

This is a moderate-severity information disclosure flaw (CVSS 6.5) in SAP NetWeaver Application Server ABAP, and the available signals are consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity attack requiring only low-privilege authentication, with confidentiality-only impact - no integrity or availability effect. EPSS corroborates a low near-term exploitation likelihood at 0.33% (24th percentile), and the CVE is NOT listed in CISA KEV and has no identified public exploit code, so there is no evidence of active or imminent mass exploitation. The limiting factor is the PR:L authentication requirement: an attacker must already hold a valid (even low-privileged) SAP account, which places this firmly in the insider/post-compromise or compromised-credential category rather than an internet-facing unauthenticated risk. No SSVC decision data was provided in the input. Net assessment: a legitimate patch-management item (data exposure in a business-critical platform) but not an emergency drop-everything priority given the authentication precondition, absence of KEV/POC signals, and low EPSS. The only mild caveat worth verifying with SAP is the scope of 'unmasked values' - the vendor rates confidentiality impact as high, but the disclosure is limited to values rendered in ABAP Lists, so real-world severity depends on what sensitive fields a given deployment displays.

An attacker with a valid low-privileged SAP ABAP user account (e.g., a disgruntled employee or an actor using phished/compromised credentials) accesses an ABAP List report over the network and observes field values that should have been masked, such as sensitive personal or financial data. No user interaction or elevated privileges are needed beyond the initial authenticated session, and no public proof-of-concept exploit has been identified.