VULNERABILITY INTELLIGENCE
CVE-2025-27435
CVSS score4.2 MEDIUM
EPSS probability0.23%
CISA KEVNot currently listed
Published2025-04-08
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Description
Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaign URL in SAP Commerce. This could allow the attacker to use the disclosed coupon code, hence posing a low impact on confidentiality and integrity of the application.
Weakness classification
- cna@sap.com: CWE-862