SAP · NetWeaver
CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
What it is
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
CISA: SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: May 20, 2025
- Added to the CISA list
- April 29, 2025
- Published
- April 24, 2025
- Severity
- Critical 10.0 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.5% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-434
- More details
- NVD · CVE.org · CISA
All references (2)
More exploited flaws from SAP
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 15, 2025 | Deserialization | NetWeaver | Critical 9.1 | 13% |
| Mar 19, 2025 | Directory Traversal | NetWeaver | High 7.5 | 95% |
| Jun 9, 2022 | SQL Injection | NetWeaver | Critical 9.8 | 72% |
| Jun 9, 2022 | Information Disclosure | NetWeaver | Medium 5.3 | 52% |
| Jun 9, 2022 | Unrestricted File Upload | NetWeaver | Critical 9.9 | 37% |
| Nov 3, 2021 | Remote Code Execution | NetWeaver | Critical 10.0 | 18% |
| Nov 3, 2021 | Directory Traversal | NetWeaver | High 7.5 | 47% |
| Nov 3, 2021 | XML External Entity (XXE) | NetWeaver | Medium 6.5 | 24% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.