CVE-2025-42982

{"id": "CVE-2025-42982", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-06-10T01:15:21.383", "references": [{"url": "https://me.sap.com/notes/3609271", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SAP GRC allows a non-administrative user to access and initiate transaction which could allow them to modify or control the transmitted system credentials. This causes high impact on confidentiality, integrity and availability of the application."}, {"lang": "es", "value": "SAP GRC permite a un usuario no administrativo acceder e iniciar transacciones que podr\u00edan permitirle modificar o controlar las credenciales del sistema transmitidas. Esto tiene un gran impacto en la confidencialidad, la integridad y la disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2025-06-12T16:06:39.330", "sourceIdentifier": "cna@sap.com"}