CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
- State
- Published
- Severity
- 10.0 Critical
- Published
- Apr 24, 2025
- Updated
- Aug 4, 2026
- Reserved
- Mar 27, 2025
Description
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 10.0 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | sap |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
SAP NetWeaver (Visual Composer development server)SAP_SE |
|
References
- https://me.sap.com/notes/3594142
- https://url.sap/sapsecuritypatchday
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/technical-description
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324government-resource
- https://www.theregister.com/2025/04/25/sap_netweaver_patch/
- https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.