Login Request a demo
Medium severity · published May 13, 2025
CVE-2025-30011
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to send an malicious request to the application, which could disclose the internal version details of the affected system. This vulnerability has low impact on confidentiality, with no effect on integrity and availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SAP Supplier Relationship Management (Live Auction Cockpit) · SAP_SE
SRM_SERVER 7.14 · source: vendor
SR
Supplier Relationship Management · Sap
7.14 · source: NVD
Affected product
SS
SAP Supplier Relationship Management (Live Auction Cockpit)
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30011
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-30011
Permissions Required
https://me.sap.com/notes/3578900
Not Applicable
https://url.sap/sapsecuritypatchday
More from SAP Supplier Relationship Management (Live Auction Cockpit)
9.8
CVE-2025-30012
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
7.5
CVE-2025-30018
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
6.1
CVE-2025-30010
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
6.1
CVE-2025-30009
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)