CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-27434: Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)
8.8
CVSS
Description
Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a high impact on the confidentiality, integrity, and availability of data in SAP Commerce.
Classification
CVE ID: CVE-2025-27434
CVSS Base Severity: HIGH
CVSS Base Score: 8.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Problem Types
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Affected Products
Vendor: SAP_SE
Product: SAP Commerce (Swagger UI)
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.03% (probability of being exploited)
EPSS Percentile: 6.34% (scored less or equal to compared to others)
EPSS Date: 2025-04-08 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-27434https://me.sap.com/notes/3569602
https://url.sap/sapsecuritypatchday