PT-2025-10678 · Sap · Sap Electronic Invoicing For Brazil

Published 2025-03-11 · Updated 2025-03-11 · CVE-2025-27432

Positive Technologies (AI Summary)

CVSS v2.0

2.7

Low

Base vector

AV:A/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Electronic Invoicing for Brazil (affected versions not specified)

Description The issue allows an authenticated attacker with certain privileges to gain unauthorized access to each transaction, potentially affecting the confidentiality of the application. By executing a specific ABAP method within the ABAP system, an attacker could call each transaction and view the inbound delivery details. This issue has a low impact on confidentiality, with no effect on the integrity and availability of the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-03629

CVE-2025-27432

Affected Products

Sap Electronic Invoicing For Brazil

References · 7

• https://bdu.fstec.ru/vul/2025-03629 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-27432 · Security Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2025.html · Note
• https://url.sap/sapsecuritypatchday · Note
• https://t.me/cvedetector/20009 · Telegram Post
• https://me.sap.com/notes/3568865 · Note
• https://t.me/cvetracker/18876 · Telegram Post