CVE-2025-30012 | The Live Auction Cockpit in SAP Supplier Relationship Manage… | CVSS 10.0 CRITICAL

Description

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to send malicious payload request in a specific encoding format. The servlet will then decode this malicious request which will result in deserialization of data in the application leading to execution of arbitrary OS command on target as SAP Administrator. This vulnerability has High impact on confidentiality, integrity, and availability of the application.

Metadata

CVE ID: CVE-2025-30012
State: PUBLISHED
Assigner: sap
Reserved: 2025-03-13 18:03 UTC
Published: 2025-05-13 00:14 UTC
Last updated: 2025-07-24 15:59 UTC
Primary CWE: CWE-502
CWE-502: Deserialization of Untrusted Data
Vendor / Product: SAP_SE / SAP Supplier Relationship Management (Live Auction Cockpit)
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
SAP_SE	SAP Supplier Relationship Management (Live Auction Cockpit)	—	SRM_SERVER 7.14

Weakness (CWE)

CWE	Source	Description
CWE-502	cna	CWE-502: Deserialization of Untrusted Data

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (2)