File Download Vulnerability in SAP Supplier Relationship Management
CVE-2025-25243

8.6HIGH

Key Information:

Vendor

SAP
Status
SAP Supplier Relationship Management (master Data Management Catalog)
Vendor
CVE Published:
11 February 2025

What is CVE-2025-25243?

A vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to exploit a publicly accessible servlet. This enables the attacker to download arbitrary files from the network without any user interaction. The exploitation of this vulnerability can lead to the exposure of highly sensitive information, posing significant risks to data privacy and security.

Affected Version(s)

SAP Supplier Relationship Management (Master Data Management Catalog) SRM_MDM_CAT 7.52

References

https://me.sap.com/notes/3567551
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.