TI-2025-27790 Aliases CVE-2025-42920 GHSA-x2fx-g3ch-j487

Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management

LOW 27CWE-79Published 2025-09-09 · Updated 2025-09-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim clicks on the link, the injected input is processed during the page generation, resulting in the execution of malicious content. This execution allows the attacker to access and modify information within the victim's browser scope, impacting confidentiality and integrity, while availability remains unaffected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00273 19th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Supplier Relationship Management	SRM_SERVER 700; 701; 702; 713; 714	—	No fix listed	CNA

SAP Supplier Relationship Management VendorSAP Affected SRM_SERVER 700; 701; 702; 713; 714 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:supplier_relationship_management:7.0:-::::::	7.0	Vulnerable	SAP

cpe:2.3:a:sap:supplier_relationship_management:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-42920
2026-10-03 Alias added: GHSA-x2fx-g3ch-j487

References

Patch 1

https://url.sap/sapsecuritypatchday

Other 1

https://me.sap.com/notes/3647098

TI-2025-21387 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) CVSS 3.1CRITICAL 10.0
TI-2025-21393 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) CVSS 3.1HIGH 8.6
TI-2023-20572 Information Disclosure in SAP Supplier Relationship Management CVSS 3.1MEDIUM 5.8
TI-2025-21386 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) CVSS 3.1MEDIUM 5.3
TI-2014-03398 Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier Relationship… CVSS 2.0MEDIUM 5.8
TI-2019-00296 Cross-site scripting in SAP Supplier Relationship Management CVSS 3.1MEDIUM 6.1

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences