9.1
CVE-2025-42999
- EPSS 11.22%
- Veröffentlicht 13.05.2025 00:17:43
- Zuletzt bearbeitet 31.10.2025 21:58:56
- Quelle cna@sap.com
- CVE-Watchlists
- Unerledigt
LoginInsecure Deserialization in SAP NetWeaver (Visual Composer development server)
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
15.05.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog
SAP NetWeaver Deserialization Vulnerability
SchwachstelleSAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.
BeschreibungApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Erforderliche Maßnahmen| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 11.22% | 0.954 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| cna@sap.com | 9.1 | 2.3 | 6 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
|
CWE-502 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://url.sap/sapsecuritypatchday
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
https://me.sap.com/notes/3604119
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42999