CVE-2025-30010

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to craft a malicious link, which when clicked by a victim, redirects the browser to a malicious site. On successful exploitation, the attacker could cause low impact on confidentiality and integrity with no impact on the availability of the application.

Score
CVSS 3.1 6.1 Medium
Status
Analyzed - cna@sap.com
Published
2025-05-13
Last modified
2025-05-13
Weaknesses
CWE-601

Affected products

References

 
 
© AVABIS GmbH privacypolicy about