8.6
CVE-2025-30018
- EPSS 0.38%
- Veröffentlicht 13.05.2025 00:16:20
- Zuletzt bearbeitet 23.10.2025 16:43:25
- Quelle cna@sap.com
- CVE-Watchlists
- Unerledigt
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerability has a high impact on the application's confidentiality, with no effect on integrity and availability of the application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Supplier Relationship Management Version7.14
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.38% | 0.297 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
| cna@sap.com | 8.6 | 3.9 | 4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
|
CWE-611 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://url.sap/sapsecuritypatchday
https://me.sap.com/notes/3578900