CVE-2025-30010 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

Medium 6.1 Published 13 May 2025 Updated 13 May 2025

An unauthenticated attacker can redirect victims to malicious sites via crafted links in SAP SRM Live Auction Cockpit, impacting confidentiality and integrity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-30010?

CVE-2025-30010 is a medium-severity vulnerability in SAP_SE SAP Supplier Relationship Management (Live Auction Cockpit), published on 13 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to craft a malicious link, which when clicked by a victim, redirects the browser to a malicious site. On successful exploitation, the attacker could cause low impact on confidentiality and integrity with no impact on the availability of the application.

Weakness: CWE-601

Which versions are affected by CVE-2025-30010?

It affects 1 product.

Products include Sap Supplier Relationship Management.

How do I fix CVE-2025-30010?

No fix has been published for CVE-2025-30010 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-30010 being exploited?

There is no known exploitation of CVE-2025-30010 in the wild and no public exploit code.

Sources

Also known as GHSA-c382-rxwx-qqcr.