Salesforce CVE-2025-43697

The risk profile is elevated based on multiple factors: (1) CVSS 7.5 with High confidence reflects unauthenticated network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and confidentiality impact (C:H); (2) The attack vector being network-based with no authentication removes significant barriers to exploitation; (3) CWE-281 (permission preservation failures) historically shows moderate-to-high exploitation rates once weaponized; (4) Salesforce OmniStudio is widely deployed across enterprise organizations, creating large attack surface; (5) The exposure of encrypted data is particularly severe in regulated industries (healthcare, finance, government) subject to HIPAA, PCI-DSS, GDPR, and FedRAMP. The lack of user interaction requirement (UI:N) eliminates social engineering as a required step. Without specific EPSS or KEV indicators in available intelligence, conservative risk assessment suggests this should be prioritized for patching within 30 days, especially for organizations handling regulated data. The encryption exposure aspect suggests sensitive data at rest or in transit could be compromised.

An external attacker discovers a Salesforce OmniStudio instance exposed to the internet (common in multi-tenant or partner portal scenarios). The attacker crafts a network request directly to the DataMapper component's endpoint without authentication credentials. Due to the improper permission preservation flaw, the DataMapper processes the request and inadvertently exposes encrypted data fields (customer PII, financial records, PHI) that should require elevated permissions. The attacker exfiltrates the encrypted data, and if encryption keys are weakly managed or discoverable, decrypts the sensitive information. In a realistic scenario: (1) attacker queries DataMapper API for customer records; (2) permission check fails due to CWE-281 flaw; (3) encrypted customer SSN/payment card fields are returned; (4) data is exfiltrated and potentially sold on darkweb. The AC:L (low complexity) indicates no special tools or techniques required—standard HTTP clients suffice. The PR:N (no privileges) means no valid Salesforce account is needed. Potential impact includes GDPR/CCPA fines, regulatory breach notifications, reputational damage, and unauthorized access to PII/PHI across hundreds or thousands of customer records depending on DataMapper query scope.