CVE-2025-27434

High

Published: 11 March 2025

Published

11 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0023 45.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27434 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Sap (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-27434 is a cross-site scripting (XSS) vulnerability in SAP Commerce, specifically affecting the Swagger UI component due to insufficient input validation. This flaw allows an unauthenticated attacker to inject malicious code from remote sources, potentially compromising the confidentiality, integrity, and availability of data within SAP Commerce. The vulnerability is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-79 (Cross-site Scripting). It was published on 2025-03-11.

An unauthenticated attacker can exploit this vulnerability over the network with low complexity, though it requires user interaction (UI:R). By tricking a user into interacting with a maliciously crafted input via the Swagger UI, the attacker can execute arbitrary JavaScript in the victim's browser context, leading to high-impact effects such as data theft, modification, or denial of service within the affected SAP Commerce instance.

SAP has addressed this issue through security advisories and patches, detailed in SAP Note 3569602 (https://me.sap.com/notes/3569602) and the SAP Security Patch Day page (https://url.sap/sapsecuritypatchday), which provide guidance on applying fixes to mitigate the XSS risk.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-7779

Vulnerability details

Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a…

high impact on the confidentiality, integrity, and availability of data in SAP Commerce.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

XSS in public-facing SAP Commerce Swagger UI directly enables exploitation of public-facing applications (T1190) and arbitrary JavaScript execution in the victim's browser (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0