CVE-2025-30017

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitation, an attacker can cause limited impact on the integrity and availability of the application.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP Solution Manager	ST 720; SAP_BASIS 700; SAP_BASIS 701; SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; SAP_BASIS 751; SAP_BASIS 752; SAP_BASIS 753; SAP_BASIS 754; SAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; SAP_BASIS 758; SAP_BASIS 914

References

Timeline

Published: Apr 8, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-300187.5The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet r CVE-2025-30027.3A vulnerability, which was classified as critical, has been found in Digital China DCME-520 up to 20250320. This issue affects some unknown CVE-2025-300226.8CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter.CVE-2025-300239.0The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execu CVE-2025-300246.8The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack.CVE-2025-300257.8The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalatio CVE-2025-300269.8The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required.CVE-2025-300276.7An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only b CVE-2025-300288.6A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.CVE-2025-30036.3A vulnerability, which was classified as critical, was found in ESAFENET CDG 3. Affected is an unknown function of the file /CDGServer3/User CVE-2025-300308.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-300318.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj