CVE-2025-27434: Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)
Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a high impact on the confidentiality, integrity, and availability of data in SAP Commerce.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27434?
CVE-2025-27434 has a high severity due to its ability to allow unauthenticated attackers to execute cross-site scripting (XSS) attacks.
How do I fix CVE-2025-27434?
To fix CVE-2025-27434, ensure that input validation is properly implemented within SAP Commerce's Swagger UI.
What kind of attack can CVE-2025-27434 enable?
CVE-2025-27434 can enable cross-site scripting (XSS) attacks, allowing attackers to inject malicious code from remote sources.
Who is affected by CVE-2025-27434?
CVE-2025-27434 affects users of SAP Commerce, particularly those utilizing the Swagger UI.
Can CVE-2025-27434 be exploited remotely?
Yes, CVE-2025-27434 can be exploited remotely by unauthenticated attackers due to insufficient input validation.