- Description
- The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to send malicious payload request in a specific encoding format. The servlet will then decode this malicious request which will result in deserialization of data in the application leading to execution of arbitrary OS command on target as SAP Administrator. This vulnerability has High impact on confidentiality, integrity, and availability of the application.
- Source
- cna@sap.com
- NVD status
- Analyzed
- Products
- supplier_relationship_management
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- cna@sap.com
- CWE-502
- Hype score
- Not currently trending
⚠️Vulnerabilidades corregidas en productos de SAP ❗CVE-2025-30012 ❗CVE-2025-42967 ❗CVE-2025-42980 ➡️Más info: https://t.co/PQZIGbm0rD https://t.co/l51C486X1j
@CERTpy
9 Jul 2025
99 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
SAP Patches Critical Flaws That Could Allow Remote Code Execution SAP's July 2025 Security Patch Day includes 27 new and four updated security notes, with six critical flaws addressed. The most severe, CVE-2025-30012 (CVSS 10), affects SRM’s Live Auction Cockpit, allowing http
@dCypherIO
9 Jul 2025
21 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
SAP releases 27 security notes with 6 critical fixes, including CVE-2025-30012 rated 10 for SRM. Vulnerabilities in S/4HANA & NetWeaver could allow full system control. Stay updated! 🔒 #SAPSecurity #Vulnerability #Germany https://t.co/x4eO5bjIm2
@TweetThreatNews
8 Jul 2025
8 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🟥 CVE-2025-30012, CVSS: 10.0 (#Critical) #SAP Supplier Relationship Management (SRM) #Vulnerability allows unauthenticated attackers to send malicious payloads, leading to execution of arbitrary OS commands as SAP Administrator. #CyberSecurity #CVE https://t.co/BEKs4JDJnn
@UjlakiMarci
7 Jul 2025
6 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
CVE-2025-30012 Java Deserialization Vulnerability in SAP SRM Live Auction Cockpit Component https://t.co/QLcyu0Ge38
@VulmonFeeds
13 May 2025
26 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-30012 The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM stack to accept binary Java obj… https://t.co/H9VGYXgIie
@CVEnew
13 May 2025
562 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:supplier_relationship_management:7.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C1A8BC33-96E4-4771-818D-92C1BB3F7E5C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]