PT-2025-20805 · Sap · Sap Srm

Published 2025-05-13 · Updated 2025-10-23 · CVE-2025-30009

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Supplier Relationship Management (SRM) (affected versions not specified)

Description The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated Java applet component, allowing an unauthenticated attacker to execute malicious script in the victim's browser. This issue has low impact on confidentiality and integrity within the scope of the victim's browser, with no effect on the availability of the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-16187

CVE-2025-30009

Affected Products

Sap Srm

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-30009 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30009 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16187 · Security Note
• https://t.me/cveNotify/140039 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2025.html · Note
• https://url.sap/sapsecuritypatchday · Note
• https://me.sap.com/notes/3578900 · Note
• https://twitter.com/CVEnew/status/1922135016374423948 · Twitter Post