CVE-2025-27434 — Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)

CVE-2025-27434

Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI) PUBLISHED

Description (CNA)

Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a high impact on the confidentiality, integrity, and availability of data in SAP Commerce.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Commerce (Swagger UI)	affected COM_CLOUD 2211

CWE

CWE-79

References

https://me.sap.com/notes/3569602
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.