CVE-2025-25243 Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)
Unauthenticated attackers can download arbitrary files via a public servlet, exposing sensitive information in SAP Supplier Relationship Management.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-25243?
CVE-2025-25243 is a high-severity path traversal vulnerability in SAP_SE SAP Supplier Relationship Management (Master Data Management Catalog), published on 11 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or availability.
Weakness: CWE-22
Which versions are affected by CVE-2025-25243?
How do I fix CVE-2025-25243?
No fix has been published for CVE-2025-25243 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-25243 being exploited?
There is no known exploitation of CVE-2025-25243 in the wild and no public exploit code.
Sources
Also known as GHSA-2c76-qm2v-h37j.