CVE-2025-24876

Published: Feb 11, 2025Modified: Jun 17, 2026Deferred

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: CNA (Secondary)

Description

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application

Related CWEs

CWE-1287

Improper Validation of Specified Type of Input

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

CWE-302

Authentication Bypass by Assumed-Immutable Data

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

References (3)

https://me.sap.com/notes/3567974

Source: cna@sap.com

https://url.sap/sapsecuritypatchday

Source: cna@sap.com

https://www.npmjs.com/package/@sap/approuter?activeTab=versions

Source: cna@sap.com

Timeline

No history available yet.