CVE-2025-31324: Missing Authorization check in SAP NetWeaver (Visual Composer development server)
First published: Thu Apr 24 2025(Updated: )
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://me.sap.com/notes/3594142
- https://url.sap/sapsecuritypatchday
- https://www.bleepingcomputer.com/news/security/sap-fixes-critical-netweaver-flaw-exploited-in-attacks/
- https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/
- https://www.theregister.com/2025/04/25/sap_netweaver_patch/
Frequently Asked Questions
What is the severity of CVE-2025-31324?
CVE-2025-31324 is considered critical due to the potential for unauthenticated code execution on affected systems.
How do I fix CVE-2025-31324?
To mitigate CVE-2025-31324, it is essential to apply the latest security patches provided by SAP for NetWeaver.
What systems are affected by CVE-2025-31324?
CVE-2025-31324 affects SAP NetWeaver versions that utilize the Visual Composer Metadata Uploader.
What type of attack is CVE-2025-31324 associated with?
CVE-2025-31324 is associated with unauthorized file uploads leading to potential remote code execution.
What could happen if CVE-2025-31324 is exploited?
Exploitation of CVE-2025-31324 could result in severe harm to the host system, including loss of data integrity and confidentiality.
- collector/mitre-cve
- source/MITRE
- agent/description
- agent/title
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/last-modified-date
- agent/author
- agent/weakness
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2025-31324
- alias/CVE-2025-27429
- alias/CVE-2025-31330
- agent/news-ai
- zeroday/true
- exploited/true
- agent/severity
- collector/the-register
- source/The Register
- alias/CVE-2017-9844
- agent/references
- agent/source
- agent/tags
- agent/event
- agent/trending
- collector/nvd-api
- source/NVD
- vendor/sap
- canonical/sap netweaver