Deserialization Vulnerability in SAP Supplier Relationship Management's Live Auction Cockpit
CVE-2025-30012

10CRITICAL

What is CVE-2025-30012?

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) utilizes a deprecated Java applet, allowing authenticated users with elevated privileges to exploit the system. By sending specifically crafted payload requests, these users can trigger an outbound DNS request that leads to the deserialization of potentially harmful data. While the impact on the application's confidentiality, integrity, and availability is noted as low, organizations using affected versions should take immediate steps to mitigate this risk by applying available security patches.

Affected Version(s)

SAP Supplier Relationship Management (Live Auction Cockpit) SRM_SERVER 7.14

References

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.