CVE-2025-42991

{"id": "CVE-2025-42991", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-06-10T01:15:22.507", "references": [{"url": "https://me.sap.com/notes/3608058", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows an authenticated 'approver' user to delete attachment from bank account application of other user, leading to a low impact on integrity, with no impact on the confidentiality of the data or the availability of the application."}, {"lang": "es", "value": "SAP S/4HANA (Aplicaci\u00f3n de Cuenta Bancaria) no realiza las comprobaciones de autorizaci\u00f3n necesarias. Esto permite que un usuario autorizador autenticado elimine archivos adjuntos de la aplicaci\u00f3n de cuenta bancaria de otro usuario, lo que reduce considerablemente la integridad y no afecta la confidencialidad de los datos ni la disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2025-06-12T16:06:39.330", "sourceIdentifier": "cna@sap.com"}