CVE-2025-26660

{"id": "CVE-2025-26660", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-03-11T01:15:35.837", "references": [{"url": "https://me.sap.com/notes/3557655", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to potentially modify data. Confidentiality and Availability are not impacted."}, {"lang": "es", "value": "Las aplicaciones SAP Fiori que utilizan la librer\u00eda de publicaci\u00f3n no configuran correctamente los par\u00e1metros de seguridad durante el proceso de configuraci\u00f3n, por lo que los dejan en los valores predeterminados o definidos de forma inadecuada. Esta vulnerabilidad permite que un atacante con pocos privilegios eluda los controles de acceso dentro de la aplicaci\u00f3n, lo que le permite modificar potencialmente los datos. La confidencialidad y la disponibilidad no se ven afectadas."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "cna@sap.com"}