Vulnerability Description
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sap | Netweaver | 7.50 |
Related Weaknesses (CWE)
References
- https://me.sap.com/notes/3594142Permissions Required
- https://url.sap/sapsecuritypatchdayVendor Advisory
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324Third Party Advisory
- https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zerPress/Media Coverage
- https://www.theregister.com/2025/04/25/sap_netweaver_patch/Press/Media Coverage
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-US Government Resource
FAQ
What is CVE-2025-31324?
CVE-2025-31324 is a vulnerability with a CVSS score of 10.0 (CRITICAL). SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely har...
How severe is CVE-2025-31324?
CVE-2025-31324 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-31324?
Check the references section above for vendor advisories and patch information. Affected products include: Sap Netweaver.