Critical · published April 24, 2025
CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 Unprotected upload point detected! The SAP NetWeaver Visual Composer Metadata Uploader lacks essential authorization, allowing any unauthenticated user to dump malicious binaries straight onto the server. 🔥 Think of it as a hotel lobby where anyone can just stroll in and drop off a suspicious package without anyone checking their ID. All it takes is one unverified delivery for chaos to ensue! An attacker could easily upload harmful executable files, leading to catastrophic data breaches, system corruption, or even complete service outages. This vulnerability poses a severe threat to the confidentiality, integrity, and availability of your system, potentially bringing your operations to a grinding halt!
Think of it as a hotel lobby where anyone can just stroll in and drop off a suspicious package without anyone checking their ID. All it takes is one unverified delivery for chaos to ensue! The vulnerability arises from improper access controls in the SAP NetWeaver Visual Composer, allowing unauthorized users to upload potentially malicious files directly to the server. This can enable remote code execution and severe damage to the host system.
An attacker could easily upload harmful executable files, leading to catastrophic data breaches, system corruption, or even complete service outages. This vulnerability poses a severe threat to the confidentiality, integrity, and availability of your system, potentially bringing your operations to a grinding halt! Immediately patch to the latest version that addresses CVE-2025-31324 and implement strict authorization checks for file uploads. Regularly audit your systems and restrict access to trusted users only! You’ve got this! With swift action, you can lock down your system and keep those threats at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| sap/netweaver | all versions | — |