CVE-2025-31324
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
Explotada activamente
- En el catálogo CISA de vulnerabilidades explotadas desde el 29 abr 2025
- Las agencias federales de EE. UU. deben corregirla antes del 20 may 2025 (BOD 22-01)
- Atacada 3 días antes de que la vulnerabilidad se hiciera pública
- Confirmada por sensores, no solo por informes
- Utilizada en campañas de ransomware
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Fuente: CISA KEV · 7 oct 2026 3 oct 2026 3 oct 2026 2 oct 2026 1 oct 2026 1 oct 2026
Puntuación CVSS10.0 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HTipo de debilidad (CWE)CWE-434
Fabricantessap
Productos afectados
| Fabricantes | Producto | Versiones |
|---|---|---|
| sap | netweaver | 7.50 |
Artículos relacionados
This product uses the NVD API but is not endorsed or certified by the NVD.