CVE-2025-42884 — JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an …
Published: 2025-11-11 · CVSS: 6.5 · CVSS 3.1
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7