Low severity · published Jul 8, 2025
CVE-2025-42978
Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java
3.5
CVSS
0.1%
EPSS
No
On KEV
Description
The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection against the wildcard hostname defined in the received certificate of remote TLS server. This might lead to the outbound connection being established to a possibly malicious remote TLS server and hence disclose information. Integrity and Availability are not impacted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver Application Server Java · SAP_SE
ENGINEAPI 7.50 · source: vendor
Affected product
SN
SAP NetWeaver Application Server Java
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-42978
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-42978
me.sap.com
https://me.sap.com/notes/3557179
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver Application Server Java
6.3
CVE-2025-0067
Missing Authorization check in SAP NetWeaver Application Server Java
5.4
CVE-2025-27431
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java
5.4
CVE-2025-0054
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java
5.3
CVE-2025-42919
Information Disclosure vulnerability in SAP NetWeaver Application Server Java
5.3
CVE-2025-42926
Missing Authentication check in SAP NetWeaver Application Server Java