CVE-2025-42997

{"id": "CVE-2025-42997", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.3}]}, "published": "2025-05-13T01:15:48.293", "references": [{"url": "https://me.sap.com/notes/3577300", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on confidentiality, integrity, and availability."}, {"lang": "es", "value": "En determinadas circunstancias, SAP Gateway Client permite a un usuario con privilegios elevados acceder a informaci\u00f3n restringida fuera del alcance de la aplicaci\u00f3n. Debido a la posibilidad de influir en el comportamiento o el rendimiento de la aplicaci\u00f3n mediante el uso indebido de los datos expuestos, esto podr\u00eda tener un impacto m\u00ednimo en la confidencialidad, la integridad y la disponibilidad."}], "lastModified": "2025-05-13T19:35:25.503", "sourceIdentifier": "cna@sap.com"}