CVE-2025-42962

{"id": "CVE-2025-42962", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2025-07-08T01:15:22.937", "references": [{"url": "https://me.sap.com/notes/3604212", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "SAP Business Warehouse (Business Explorer Web) allows an attacker to create a malicious link. If an authenticated user clicks on this link, the injected script gets executed within the scope of victim\ufffds browser. This potentially leads to an impact on confidentiality and integrity. Availability is not impacted."}, {"lang": "es", "value": "SAP Business Warehouse (Business Explorer Web) permite a un atacante crear un enlace malicioso. Si un usuario autenticado hace clic en este enlace, el script inyectado se ejecuta en el navegador de la v\u00edctima. Esto podr\u00eda afectar la confidencialidad y la integridad. La disponibilidad no se ve afectada."}], "lastModified": "2025-07-08T16:18:14.207", "sourceIdentifier": "cna@sap.com"}