CVE-2025-42895

MEDIUM EPSS 3.3%

Published Nov 11, 20257mo ago · Modified Jun 17, 20261w ago

6.9 CVSS 3.1

Medium

Published Nov 11, 2025 7mo ago

Last Modified Jun 17, 2026 1w ago

Description

Due to insufficient validation of connection property values, the SAP HANA JDBC Client allows a high-privilege locally authenticated user to supply crafted parameters that lead to unauthorized code loading, resulting in low impact on confidentiality and integrity and high impact on availability of the application.

CVSS Details

Base Score

6.9

Exploitability

1.1

Impact

5.3

Vector string

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required High

User Interaction Required

Scope Changed

Confidentiality Low

Integrity Low

Availability High

Threat Intelligence

EPSS Exploit Probability

3.3% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-94 Improper Control of Generation of Code (Code Injection) Injection

References 2

me.sap.com https://me.sap.com/notes/3643385
url.sap https://url.sap/sapsecuritypatchday

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.