CVE-2025-42996

{"id": "CVE-2025-42996", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.2}]}, "published": "2025-06-10T01:15:23.143", "references": [{"url": "https://me.sap.com/notes/3610006", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-590"}]}], "descriptions": [{"lang": "en", "value": "SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticate giving the ability to access or modify non-sensitive information or consume sufficient resources which could degrade the performance of the server causing low impact on confidentiality, integrity and availibility of the application."}, {"lang": "es", "value": "SAP MDM Server permite a un atacante obtener el control de las sesiones de cliente existentes y ejecutar ciertas funciones sin tener que volver a autenticarse, lo que brinda la capacidad de acceder o modificar informaci\u00f3n no confidencial o consumir recursos suficientes que podr\u00edan degradar el rendimiento del servidor y causar un impacto bajo en la confidencialidad, integridad y disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2025-06-12T16:06:39.330", "sourceIdentifier": "cna@sap.com"}