"SAP has rolled out security fixes for 13 new security issues, including additional hardening for a maximum-severity bug in SAP NetWeaver AS Java that could result in arbitrary command execution. The vulnerability, tracked as CVE-2025-42944, carries a CVSS score of 10.0. It has been described as a case of insecure deserialization. "Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting a malicious payload to an open port," according to a description of the flag in CVE.org. "The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application's confidentiality, integrity, and availability.""
""The additional layer of protection is based on implementing a JVM-wide filter (jdk.serialFilter) that prevents dedicated classes from being deserialized," it noted. "The list of recommended classes and packages to block was defined in collaboration with the ORL and is divided into a mandatory section and an optional section.""
"Another critical vulnerability of note is CVE-2025-42937 (CVSS score: 9.8), a directory traversal flaw in SAP Print Service that arises as a result of insufficient path validation, allowing an unauthenticated attacker to reach the parent directory and overwrite system files. The third critical flaw patched by SAP concerns an unrestricted file upload bug in SAP Supplier Relationship Management ( CVE-2025-42910, CVSS score: 9.0) that could permit an attacker to upload arbitrary files, including malicious executables that could impact the confidentiality, integrity, and availability of the application."
SAP released fixes for 13 security issues, adding extra hardening for a maximum-severity insecure deserialization in NetWeaver AS Java that could permit arbitrary OS command execution. The issue, CVE-2025-42944, has a CVSS score of 10.0 and can be exploited via the RMI-P4 module by submitting a malicious payload to an open port. Onapsis reported the update implements a JVM-wide serial filter (jdk.serialFilter) to block specific classes and packages, with mandatory and optional lists defined with the ORL. Additional critical fixes include a directory traversal in SAP Print Service (CVE-2025-42937, CVSS 9.8) and an unrestricted file upload in SAP Supplier Relationship Management (CVE-2025-42910, CVSS 9.0). No evidence of in-the-wild exploitation has been reported.
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]