Deserialization Vulnerability in SAP Supplier Relationship Management's Live Auction Cockpit

CVE-2025-30012

What is CVE-2025-30012?

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) utilizes a deprecated Java applet, allowing authenticated users with elevated privileges to exploit the system. By sending specifically crafted payload requests, these users can trigger an outbound DNS request that leads to the deserialization of potentially harmful data. While the impact on the application's confidentiality, integrity, and availability is noted as low, organizations using affected versions should take immediate steps to mitigate this risk by applying available security patches.

References