Low severity · published Aug 12, 2025
CVE-2025-42941
Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad)
3.5
CVSS
0.2%
EPSS
No
On KEV
Description
SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link (<a>) elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pages. While administrative access is necessary for certain configurations, the attacker does not need the administrative privileges to execute the attack. This could result in unintended manipulation of user sessions or exposure of sensitive information. The issue impacts the confidentiality and integrity of the system, but the availability remains unaffected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
SAP Fiori (Launchpad) · SAP_SE
SAP_UI 754 · source: vendor
Affected product
SF
SAP Fiori (Launchpad)
SAP_SE
More from SAP Fiori (Launchpad)
5.3
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad
4.2
CVE-2026-24315
Path Traversal Vulnerability in SAP Fiori (launchpad)