SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://me.sap.com/notes/3604119 | Permissions Required |
| https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ | Exploit Third Party Advisory |
| https://url.sap/sapsecuritypatchday | Not Applicable |
Configurations
History
16 May 2025, 19:44
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sap:netweaver:7.5:*:*:*:*:*:*:* | |
| First Time |
Sap netweaver
Sap |
|
| References | () https://url.sap/sapsecuritypatchday - Not Applicable | |
| References | () https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ - Exploit, Third Party Advisory | |
| References | () https://me.sap.com/notes/3604119 - Permissions Required |
13 May 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 May 2025, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-13 01:15
Updated : 2025-05-16 19:44
NVD link : CVE-2025-42999
Mitre link : CVE-2025-42999
JSON object : View
Products Affected
sap
- netweaver
CWE
No CWE.