Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) (SAP_SE SAP Supplier Relationship Management (Live Auction Cockpit))

CVE-2025-30011
MEDIUM 5.3

En bref

Source
NVD
EPSS
EPSS 0.37 % · centile 31 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
sap
Statut NVD
Analyzed

Rechercher sur…

Description

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to send an malicious request to the application, which could disclose the internal version details of the affected system. This vulnerability has low impact on confidentiality, with no effect on integrity and availability of the application.

Faiblesses (CWE)

  • CWE-497 — Exposition d'informations système sensibles à une sphère non autorisée

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsap
CVSS 3.1MEDIUM 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NNVD · cna@sap.com (Secondary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
SAP_SE · SAP Supplier Relationship Management (Live Auction Cockpit)affected SRM_SERVER 7.14

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD