CVE-2025-25243CWE-22

Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)

High · published February 11, 2025

CVSS v3.1
8.6
EPSS
1%
Percentile
52.5
In the wild
Unconfirmed
What it is

SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or availability.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00697 · 52.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-02-11T00:38Z
EPSS history
Timeline
  • 11 FEB 00:38Z
    Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)
    cvelistv5