CVE-2025-27434CWE-79

Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)

High · published March 11, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a high impact on the confidentiality, integrity, and availability of data in SAP Commerce.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00454 · 38.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-03-11T00:39Z
EPSS history
Timeline
  • 11 MAR 00:39Z
    Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)
    cvelistv5