FKIE_CVE-2025-0059

Vulnerability from fkie_nvd - Published: 2025-01-14 01:15 - Updated: 2025-01-14 01:15
Severity ?
6.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Summary
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
References
cna@sap.comhttps://me.sap.com/notes/3503138
cna@sap.comhttps://url.sap/sapsecuritypatchday
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim\ufffds user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application."
    },
    {
      "lang": "es",
      "value": " Las aplicaciones basadas en SAP GUI para HTML en SAP NetWeaver Application Server ABAP almacenan la informaci\u00f3n ingresada por el usuario en el almacenamiento local del navegador para mejorar la usabilidad. Un atacante con privilegios administrativos o acceso al directorio de usuarios de la v\u00edctima en el nivel del sistema operativo podr\u00eda leer estos datos. Dependiendo de la informaci\u00f3n ingresada por el usuario en las transacciones, los datos divulgados podr\u00edan variar desde datos no cr\u00edticos hasta datos altamente sensibles, lo que causa un alto impacto en la confidencialidad de la aplicaci\u00f3n."
    }
  ],
  "id": "CVE-2025-0059",
  "lastModified": "2025-01-14T01:15:16.190",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 4.0,
        "source": "cna@sap.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-01-14T01:15:16.190",
  "references": [
    {
      "source": "cna@sap.com",
      "url": "https://me.sap.com/notes/3503138"
    },
    {
      "source": "cna@sap.com",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-497"
        }
      ],
      "source": "cna@sap.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.