CVE-2025-26655

{"id": "CVE-2025-26655", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "published": "2025-03-11T01:15:35.230", "references": [{"url": "https://me.sap.com/notes/3347991", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise be restricted, potentially causing a low impact on the integrity of the application.Confidentiality and Availability are not impacted."}, {"lang": "es", "value": "SAP Just In Time (JIT) no realiza las verificaciones de autorizaci\u00f3n necesarias para un usuario autenticado, lo que permite al atacante escalar privilegios que de otro modo estar\u00edan restringidos, lo que potencialmente causa un impacto bajo en la integridad de la aplicaci\u00f3n. La confidencialidad y la disponibilidad no se ven afectadas."}], "lastModified": "2025-03-11T01:15:35.230", "sourceIdentifier": "cna@sap.com"}