CVE-2025-0059
Jan. 14, 2025, 1:15 a.m.
6.0
Medium
Description
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
Product(s) Impacted
| Product | Versions |
|---|---|
| SAP GUI for HTML in SAP NetWeaver Application Server ABAP |
|
Weaknesses
CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
Tags
CVSS Score
CVSS Data
- Attack Vector: LOCAL
- Attack Complexity: LOW
- Privileges Required: HIGH
- Scope: CHANGED
- Confidentiality Impact: HIGH
- Integrity Impact: NONE
- Availability Impact: NONE
View Vector String
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Date
- Published: Jan. 14, 2025, 1:15 a.m.
- Last Modified: Jan. 14, 2025, 1:15 a.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
cna@sap.com
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.