CVE-2025-42878

SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3684682
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) SAP Web Dispatcher e ICM pueden exponer interfaces de prueba internas que no están destinadas a producción. Si están habilitadas, atacantes no autenticados podrían explotarlas para acceder a diagnósticos, enviar solicitudes manipuladas o interrumpir servicios. Esta vulnerabilidad tiene un alto impacto en la confidencialidad, disponibilidad y bajo impacto en la integridad y de la aplicación.

Information

Published : 2025-12-09 16:17

Updated : 2026-10-07 20:10

NVD link : CVE-2025-42878

Mitre link : CVE-2025-42878

CVE.ORG link : CVE-2025-42878

JSON object : View

Products Affected

No product.

CWE

CWE-1244

Internal Asset Exposed to Unsafe Debug Access Level or State

{"id": "CVE-2025-42878", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-42878", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-09T16:39:22.251146Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Web Dispatcher and Internet Communication Manager (ICM)", "versions": [{"status": "affected", "version": "KRNL64NUC 7.22"}, {"status": "affected", "version": "7.22EXT"}, {"status": "affected", "version": "KRNL64UC 7.22"}, {"status": "affected", "version": "7.53"}, {"status": "affected", "version": "WEBDISP 7.22_EXT"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.89"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}, {"status": "affected", "version": "KERNEL 7.22"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-09T16:17:52.230", "references": [{"url": "https://me.sap.com/notes/3684682", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-1244"}]}], "descriptions": [{"lang": "en", "value": "SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application."}, {"lang": "es", "value": "SAP Web Dispatcher e ICM pueden exponer interfaces de prueba internas que no est\u00e1n destinadas a producci\u00f3n. Si est\u00e1n habilitadas, atacantes no autenticados podr\u00edan explotarlas para acceder a diagn\u00f3sticos, enviar solicitudes manipuladas o interrumpir servicios. Esta vulnerabilidad tiene un alto impacto en la confidencialidad, disponibilidad y bajo impacto en la integridad y de la aplicaci\u00f3n."}], "lastModified": "2026-10-07T20:10:01.970", "sourceIdentifier": "cna@sap.com"}