PT-2025-20808 · Sap · Sap Supplier Relationship Management

Published 2025-05-13 · Updated 2025-10-23 · CVE-2025-30012

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Supplier Relationship Management (SRM) versions prior to July 2025 patch SAP SRM Live Auction Cockpit version 7.14

Description The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) utilizes a deprecated Java applet component that is susceptible to accepting binary Java objects in a specific encoding format. Successful exploitation by an unauthenticated attacker could allow the sending of malicious payload requests, leading to deserialization of data within the application and potential execution of arbitrary OS commands with SAP Administrator privileges. The vulnerability poses a high impact on the confidentiality, integrity, and availability of the application. While some reports indicate a low impact, other sources report a critical impact with a CVSS score of 10.0. The vulnerability allows for complete system compromise through deserialization.

API Endpoints: Not specified. Vulnerable Parameters or Variables: Not specified. Function Names: Not specified.

Recommendations For SAP SRM versions prior to July 2025 patch, apply the July 2025 security patches. For SAP SRM Live Auction Cockpit version 7.14, apply the July 2025 security patches and disable Java applets.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-30012

Affected Products

Sap Supplier Relationship Management

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-30012 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30012 · Vendor Advisory
• https://twitter.com/TweetThreatNews/status/1942587654576525382 · Twitter Post
• https://twitter.com/UjlakiMarci/status/1942256132698890348 · Twitter Post
• https://twitter.com/dCypherIO/status/1942954393222971452 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/gothburz/status/1942637637799383221 · Twitter Post
• https://t.me/cveNotify/140037 · Telegram Post
• https://t.me/cvetracker/23677 · Telegram Post
• https://me.sap.com/notes/3578900 · Note
• https://twitter.com/CVEnew/status/1922135013912420553 · Twitter Post
• https://twitter.com/onapsis/status/1945927761647812667 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1922244597331214825 · Twitter Post