CVE-2025-27435

{"id": "CVE-2025-27435", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}]}, "published": "2025-04-08T08:15:16.550", "references": [{"url": "https://me.sap.com/notes/3539465", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaign URL in SAP Commerce. This could allow the attacker to use the disclosed coupon code, hence posing a low impact on confidentiality and integrity of the application."}, {"lang": "es", "value": "Bajo ciertas condiciones y requisitos previos, un atacante no autenticado podr\u00eda acceder a los c\u00f3digos de cup\u00f3n de los clientes expuestos en los par\u00e1metros de la URL de la campa\u00f1a de cupones en SAP Commerce. Esto podr\u00eda permitirle usar el c\u00f3digo de cup\u00f3n revelado, con un impacto m\u00ednimo en la confidencialidad e integridad de la aplicaci\u00f3n."}], "lastModified": "2025-04-08T18:13:53.347", "sourceIdentifier": "cna@sap.com"}