CVE-2025-26657CWE-862

Information Disclosure vulnerability in SAP KMC WPC

Medium · published April 8, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
24.1
In the wild
Unconfirmed
What it is

SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00323 · 24.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-04-08T07:13Z
EPSS history
Timeline
  • 08 APR 07:13Z
    Information Disclosure vulnerability in SAP KMC WPC
    cvelistv5