CVE-2025-42897CWE-522

CVE-2025-42897

Medium · published November 11, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

Due to information disclosure vulnerability in anonymous API provided by SAP Business One (SLD), an attacker with normal user access could gain access to unauthorized information. As a result, it has a low impact on the confidentiality of the application but no impact on the integrity and availability.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00248 · 15.2th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2025-11-11T06:15Z
References (2)
https://me.sap.com/notes/3652901 · [email protected]https://url.sap/sapsecuritypatchday · [email protected]
EPSS history
Timeline
  • 11 NOV 00:19Z
    Information Disclosure vulnerability in SAP Business One (SLD)
    cvelistv5