CVE-2025-30018: Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerability has a high impact on the application's confidentiality, with no effect on integrity and availability of the application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30018?
CVE-2025-30018 is classified with a high severity due to its potential to allow unauthenticated attackers to access sensitive files and data.
How do I fix CVE-2025-30018?
To fix CVE-2025-30018, ensure that you apply the latest security patches provided by SAP for the Supplier Relationship Management product.
What is the impact of CVE-2025-30018?
The impact of CVE-2025-30018 includes unauthorized access to sensitive files and data due to improper handling of XML file submissions.
Who is affected by CVE-2025-30018?
CVE-2025-30018 affects users of the SAP Supplier Relationship Management software who have not implemented the necessary security updates.
Is authentication required to exploit CVE-2025-30018?
No authentication is required to exploit CVE-2025-30018, making it particularly dangerous for exposed systems.