CVE-2025-30011

5.3 mediumEPSS 0.4%

Medium (5.3) in sap supplier relationship management. EPSS 0.4% chance of exploitation in the next 30 days.

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to send an malicious request to the application, which could disclose the internal version details of the affected system. This vulnerability has low impact on confidentiality, with no effect on integrity and availability of the application.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-497
Published: 2025-05-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sap:supplier_relationship_management

References

https://me.sap.com/notes/3578900
https://url.sap/sapsecuritypatchday

Check your stack JSON