CVE-2025-42938 · CVSS 3.0 6.1 · SAP Note 3629325
SAP has revised its September 2025 XSS advisory rather than assigned a new October vulnerability. Note 3629325 version 13, released on 13 October 2026, updates the solution, validity and correction instructions for CVE-2025-42938. Previously closed remediation records deserve another look.
The underlying issue
An unauthenticated attacker can create a malicious link. If an authenticated user follows it, insufficiently encoded input can produce script in the victim’s browser context. SAP rates the vulnerability CVSS 6.1, Medium priority, with confidentiality and integrity impacts and no availability impact. The correction encodes URL parameters.
Check the component-level applicability
Although the title refers broadly to the NetWeaver ABAP Platform, the listed components are S4CRM 100, 200, 204, 205 and 206; S4CEXT 107 and 108; and BBPCRM 713 and 714. Match your inventory against that table and the current correction instructions. Do not infer that every SAP_BASIS installation is affected from the title alone.
The manual step matters for S4CEXT
The note’s manual activity applies to S4CEXT 107 through SAPK-10704INS4CEXT and 108 through SAPK-10801INS4CEXT. It directs customers to implement Note 3499472, including all its correction instructions. For other listed components, use the relevant correction instructions or support packages. Record version 13 in the reassessment and verify the applicable manual activity as well as automated correction status.
Advisory details
Component: CRM-BF-ML
SAP priority: Correction with medium priority
First release: 09.09.2025
Reviewed release: 13 October 2026, note version 13
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: SAP Security Note 3629325 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
