CVE-2025-26657

{"id": "CVE-2025-26657", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-04-08T08:15:16.077", "references": [{"url": "https://me.sap.com/notes/3568307", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability."}, {"lang": "es", "value": "SAP KMC WPC permite que un atacante no autenticado obtenga nombres de usuario de forma remota mediante una simple consulta de par\u00e1metros, lo que podr\u00eda exponer informaci\u00f3n confidencial, con un impacto m\u00ednimo en la confidencialidad de la aplicaci\u00f3n. Esto no afecta la integridad ni la disponibilidad."}], "lastModified": "2025-04-08T18:13:53.347", "sourceIdentifier": "cna@sap.com"}