CVE-2025-30012

Severity CVSS v4.0:

Pending analysis

Type:

CWE-502 Deserialization of Untrusted Dat

Publication date:

13/05/2025

Last modified:

13/05/2025

Description

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM stack to accept binary Java objects in specific encoding format. On successful exploitation, an authenticated attacker with high privileges could send malicious payload request and receive an outbound DNS request, resulting in deserialization of data in the application. This vulnerability has low impact on confidentiality, integrity and availability of the application.

Impact

Vector 3.x

CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L CVSS v3.1 Severity and Metrics:

Base Score: 3.90 LOW
Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Attack Vector (AV): Adjacent
Attack Complexity (AC): High
Privileges Required (PR): High
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): Low
Integrity (I): Low
Availability (A): Low

Base Score 3.x

3.90

Severity 3.x

LOW

CVE-2025-30012

Description

Impact

References to Advisories, Solutions, and Tools