CVE-2025-30011

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to send an malicious request to the application, which could disclose the internal version details of the affected system. This vulnerability has low impact on confidentiality, with no effect on integrity and availability of the application.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-300129.8The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthentica CVE-2025-300136.7SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed wi CVE-2025-300147.7SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker wit CVE-2025-300154.1Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker CVE-2025-300169.8SAP Financial Consolidation allows an unauthenticated attacker to gain unauthorized access to the Admin account. The vulnerability arises du CVE-2025-300174.4Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution CVE-2025-300187.5The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet r CVE-2025-30027.3A vulnerability, which was classified as critical, has been found in Digital China DCME-520 up to 20250320. This issue affects some unknown CVE-2025-300226.8CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter.CVE-2025-300239.0The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execu CVE-2025-300246.8The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack.CVE-2025-300257.8The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalatio