CVE-2025-30011

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-30011
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to send an malicious request to the application, which could disclose the internal version details of the affected system. This vulnerability has low impact on confidentiality, with no effect on integrity and availability of the application.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://me.sap.com/notes/3578900 Permissions Required
https://url.sap/sapsecuritypatchday Not Applicable
Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:supplier_relationship_management:7.14:*:*:*:*:*:*:*
History

23 Oct 2025, 16:55

Type Values Removed Values Added
References () https://me.sap.com/notes/3578900 - () https://me.sap.com/notes/3578900 - Permissions Required
References () https://url.sap/sapsecuritypatchday - () https://url.sap/sapsecuritypatchday - Not Applicable
First Time Sap supplier Relationship Management
Sap
CPE cpe:2.3:a:sap:supplier_relationship_management:7.14:*:*:*:*:*:*:*

13 May 2025, 19:35

Type Values Removed Values Added
Summary
  • (es) Live Auction Cockpit de SAP Supplier Relationship Management (SRM) utiliza un componente de applet de Java obsoleto dentro de los paquetes SRM afectados, lo que permite a un atacante no autenticado enviar una solicitud maliciosa a la aplicación, lo que podría revelar la información de la versión interna del sistema afectado. Esta vulnerabilidad tiene un impacto bajo en la confidencialidad y no afecta la integridad ni la disponibilidad de la aplicación.

13 May 2025, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-13 01:15

Updated : 2025-10-23 16:55

NVD link : CVE-2025-30011

Mitre link : CVE-2025-30011

CVE.ORG link : CVE-2025-30011

JSON object : View

Products Affected

sap

  • supplier_relationship_management
CWE
CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere