Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-31324

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

Published

2025-04-24T17:15:35.913

Last Modified

2025-05-06T20:59:33.773

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 10.0 (CRITICAL)

Weaknesses

Type: Primary
CWE-434

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	sap	netweaver	7.50	Yes

References

https://me.sap.com/notes/3594142 Permissions Required ([email protected])
https://url.sap/sapsecuritypatchday Vendor Advisory ([email protected])
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/ Press/Media Coverage (af854a3a-2127-422b-91ae-364da2661108)
https://www.theregister.com/2025/04/25/sap_netweaver_patch/ Press/Media Coverage (af854a3a-2127-422b-91ae-364da2661108)
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ Third Party Advisory (134c704f-9b21-4f2e-91b3-4a467353bcc0)