CRITICAL

CVE-2025-31324

Sap Netweaver 2025-04-24 CVSS v3.1

CVSS

9.8

KEV

Description

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

Summary dbcve.org

SAP NetWeaver Visual Composer Metadata Uploader lacks proper authorization checks, allowing unauthenticated attackers to upload potentially malicious executable binaries directly to the server. This can lead to remote code execution, enabling full compromise of the host system and the SAP environment.

Mitigation

Restrict network access to the Visual Composer Metadata Uploader endpoint (typically /VC_MetadataUploader) until an official SAP patch is available; consider disabling the component if unused or implementing WAF rules to block executable upload attempts.

Weakness (CWE)

CWE-434 Unrestricted File Upload

EPSS Score

99.47%

Probability of exploitation in next 30 days

99.9th percentile

References

https://me.sap.com/notes/3594142 Permissions Required https://url.sap/sapsecuritypatchday Vendor Advisory https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ Third Party Advisory https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/ Press/Media Coverage https://www.theregister.com/2025/04/25/sap_netweaver_patch/ Press/Media Coverage https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE