CVE-2025-30011 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

Medium 5.3 Published 13 May 2025 Updated 13 May 2025

Unauthenticated attackers can disclose internal version details via a deprecated Java applet in SAP SRM Live Auction Cockpit.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-30011?

CVE-2025-30011 is a medium-severity vulnerability in SAP_SE SAP Supplier Relationship Management (Live Auction Cockpit), published on 13 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to send an malicious request to the application, which could disclose the internal version details of the affected system. This vulnerability has low impact on confidentiality, with no effect on integrity and availability of the application.

Weakness: CWE-497

Which versions are affected by CVE-2025-30011?

It affects 1 product.

Products include Sap Supplier Relationship Management.

How do I fix CVE-2025-30011?

No fix has been published for CVE-2025-30011 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-30011 being exploited?

There is no known exploitation of CVE-2025-30011 in the wild and no public exploit code.

Sources

Also known as GHSA-xrxq-x8xp-9x7h.