{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-22T12:00:55.595","vulnerabilities":[{"cve":{"id":"CVE-2025-42965","sourceIdentifier":"cna@sap.com","published":"2025-07-08T01:15:23.440","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configuration. By analysing response times for various IP addresses and ports, the attacker can infer valid network endpoints. Successful exploitation may lead to information disclosure. This vulnerability does not impact the integrity or availability of the application."},{"lang":"es","value":"SAP CMC Promotion Management permite a un atacante autenticado enumerar sistemas de red internos mediante el envío de solicitudes manipuladas durante la configuración del origen del trabajo. Al analizar los tiempos de respuesta de diversas direcciones IP y puertos, el atacante puede inferir endpoints de red válidos. Una explotación exitosa puede conllevar la divulgación de información. Esta vulnerabilidad no afecta la integridad ni la disponibilidad de la aplicación. "}],"metrics":{"cvssMetricV31":[{"source":"cna@sap.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":1.4}]},"weaknesses":[{"source":"cna@sap.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://me.sap.com/notes/3598118","source":"cna@sap.com"},{"url":"https://url.sap/sapsecuritypatchday","source":"cna@sap.com"}]}}]}