CVE-2025-30018 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

High 8.6 Published 13 May 2025 Updated 13 May 2025

Unauthenticated attackers can exploit XML parsing flaws in SAP SRM Live Auction Cockpit to access sensitive files and data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-30018?

CVE-2025-30018 is a high-severity vulnerability in SAP_SE SAP Supplier Relationship Management (Live Auction Cockpit), published on 13 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerability has a high impact on the application's confidentiality, with no effect on integrity and availability of the application.

Weakness: CWE-611

Which versions are affected by CVE-2025-30018?

It affects 1 product.

Products include Sap Supplier Relationship Management.

How do I fix CVE-2025-30018?

No fix has been published for CVE-2025-30018 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-30018 being exploited?

There is no known exploitation of CVE-2025-30018 in the wild and no public exploit code.

Sources

Also known as GHSA-wwrf-457v-6cqw.