« Volver al listado

CVE-2025-30014

Estado: AplazadaAlta (7.7)—

SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to read files from directory which they don�t have access to, hence causing a high impact on confidentiality. Integrity and Availability are not affected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N PR:L sin UI sugiere servicio remoto con privilegios bajos. Directory traversal (CWE-35) permite leer archivos sin acceso autorizado, afectando confidencialidad (C:H). T1005 y T1552 cubren la exfiltración de datos/credenciales accesibles via path traversal.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementUpdate SoftwareActive Directory ConfigurationVulnerability ScanningUser TrainingThreat Intelligence Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

SAP — Capital Yield TAX ManagementAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-30014",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-30014",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-08T13:23:29.480155Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Capital Yield Tax Management",
          "versions": [
            {
              "status": "affected",
              "version": "CYTERP 420_700"
            },
            {
              "status": "affected",
              "version": "CYT 800"
            },
            {
              "status": "affected",
              "version": "IBS 7.0"
            },
            {
              "status": "affected",
              "version": "CYT4HANA 100"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-08T08:15:17.177",
  "references": [
    {
      "url": "https://me.sap.com/notes/2927164",
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-35"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to read files from directory which they don�t have access to, hence causing a high impact on confidentiality. Integrity and Availability are not affected."
    },
    {
      "lang": "es",
      "value": "SAP Capital Yield Tax Management presenta una vulnerabilidad de directory traversal debido a una validación de ruta insuficiente. Esto podría permitir que un atacante con pocos privilegios lea archivos de un directorio al que no tiene acceso, lo que afecta gravemente la confidencialidad. La integridad y la disponibilidad no se ven afectadas."
    }
  ],
  "lastModified": "2026-06-17T09:08:02.337",
  "sourceIdentifier": "cna@sap.com"
}