Missing Authorization check in SAP NetWeaver (Visual Composer development server) (SAP_SE SAP NetWeaver (Visual Composer development server))
At a glance
- Source
- NVD
- EPSS
- EPSS 99.49 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Analyzed
Description
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
Weaknesses (CWE)
- CWE-434 — Unrestricted Upload of File with Dangerous Type
References
- https://me.sap.com/notes/3594142
- https://url.sap/sapsecuritypatchday
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324
- https://www.theregister.com/2025/04/25/sap_netweaver_patch/
- https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | sap |
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-11987
- GCVE · GCVE-0-2025-31324
CERT-FR advisories
- CERTFR-2025-AVI-0396 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0350 — Vulnérabilité dans SAP NetWeaver · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0285 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2025-ALE-005 — Vulnérabilité dans SAP NetWeaver · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP NetWeaver (Visual Composer development server) | affected VCFRAMEWORK 7.50 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |