Security Flaw in SAP Supplier Relationship Management Utilizing Deprecated Java Applet
CVE-2025-30011

5.3MEDIUM

Key Information:

Vendor

SAP
Status
SAP Supplier Relationship Management (live Auction Cockpit)
Vendor
CVE Published:
13 May 2025

What is CVE-2025-30011?

The Live Auction Cockpit within SAP Supplier Relationship Management (SRM) is compromised by the use of a deprecated Java applet component. This security flaw enables unauthenticated attackers to send malicious requests, potentially exposing sensitive internal version details of the SRM system. Although the impact on confidentiality is considered low, organizations should be aware that this vulnerability does not affect the overall integrity or availability of the application. It is critical for users of SAP SRM to assess their systems and apply necessary security patches to mitigate this risk.

Affected Version(s)

SAP Supplier Relationship Management (Live Auction Cockpit) SRM_SERVER 7.14

References

https://me.sap.com/notes/3578900
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.