by Kastro
Paper/Archive/CVE-2025-42910

CVE-2025-42910

SAP_SE SAP Supplier Relationship Management — Unrestricted File Upload Vulnerability in SAP Supplier Relationship Management

EPSS 0.5%CVSS 9.0
critical.is priorityof 100
35
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 41.4.414 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application.

Affected

ProductAffectedFixed inSource
SAP Supplier Relationship ManagementSRMNXP01 100–CNA
SAP Supplier Relationship Management150–CNA

Scores by source

sap (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3647332refurl.sap/sapsecuritypatchday