CVE-2025-31324

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-31324
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://me.sap.com/notes/3594142 Permissions Required
https://url.sap/sapsecuritypatchday Vendor Advisory
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ Third Party Advisory
https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/ Press/Media Coverage
https://www.theregister.com/2025/04/25/sap_netweaver_patch/ Press/Media Coverage
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324
Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:*
History

21 Oct 2025, 23:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:21

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324 -

02 May 2025, 14:22

Type Values Removed Values Added
References () https://me.sap.com/notes/3594142 - () https://me.sap.com/notes/3594142 - Permissions Required
References () https://url.sap/sapsecuritypatchday - () https://url.sap/sapsecuritypatchday - Vendor Advisory
References () https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/ - () https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/ - Press/Media Coverage
References () https://www.theregister.com/2025/04/25/sap_netweaver_patch/ - () https://www.theregister.com/2025/04/25/sap_netweaver_patch/ - Press/Media Coverage
References () https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ - () https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ - Third Party Advisory
CPE cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:*
First Time Sap
Sap netweaver

01 May 2025, 20:15

Type Values Removed Values Added
References
  • () https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ -

26 Apr 2025, 01:15

Type Values Removed Values Added
References
  • () https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/ -
  • () https://www.theregister.com/2025/04/25/sap_netweaver_patch/ -
Summary
  • (es) SAP NetWeaver Visual Composer Metadata Uploader no cuenta con la protección adecuada, lo que permite que agentes no autenticados carguen archivos binarios ejecutables potencialmente maliciosos que podrían dañar gravemente el sistema host. Esto podría afectar significativamente la confidencialidad, la integridad y la disponibilidad del sistema objetivo.

24 Apr 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-24 17:15

Updated : 2025-10-21 23:16

NVD link : CVE-2025-31324

Mitre link : CVE-2025-31324

CVE.ORG link : CVE-2025-31324

JSON object : View

Products Affected

sap

  • netweaver
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type