Medium severity · published Nov 11, 2025
CVE-2025-42893
Open Redirect vulnerability in SAP Business Connector
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site displayed within an embedded frame. Successful exploitation could allow the attacker to steal sensitive information and perform unauthorized actions, impacting the confidentiality and integrity of web client data. There is no impact to system availability resulting from this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP Business Connector · SAP_SE
SAP BC 4.8 · source: vendor
BC
Business Connector · Sap
4.8 · source: NVD
Affected product
SB
SAP Business Connector
SAP_SE
More from SAP Business Connector
6.8
CVE-2025-42894
Path Traversal vulnerability in SAP Business Connector
6.8
CVE-2025-42892
OS Command Injection vulnerability in SAP Business Connector
6.1
CVE-2026-0514
Cross-Site Scripting (XSS) vulnerability in SAP Business Connector
6.1
CVE-2025-42886
Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector