The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to send an malicious request to the application, which could disclose the internal version details of the affected system. This vulnerability has low impact on confidentiality, with no effect on integrity and availability of the application.
References
| Link | Resource |
|---|---|
| https://me.sap.com/notes/3578900 | Permissions Required |
| https://url.sap/sapsecuritypatchday | Not Applicable |
Configurations
History
23 Oct 2025, 16:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://me.sap.com/notes/3578900 - Permissions Required | |
| References | () https://url.sap/sapsecuritypatchday - Not Applicable | |
| First Time |
Sap supplier Relationship Management
Sap |
|
| CPE | cpe:2.3:a:sap:supplier_relationship_management:7.14:*:*:*:*:*:*:* |
13 May 2025, 19:35
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-13 01:15
Updated : 2025-10-23 16:55
NVD link : CVE-2025-30011
Mitre link : CVE-2025-30011
CVE.ORG link : CVE-2025-30011
JSON object : View
Products Affected
sap
- supplier_relationship_management
CWE
CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere