SAP Security Notes, May 2025

Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems.

May 2025 Notes

Summary and Highlights of the Month

Full details

The complete detail of the most relevant notes is as follows:

1. Update – Missing Authorization check in SAP NetWeaver (Visual Composer development server) (3594142): SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system. The solution is to apply authentication requirements and authorization restrictions reflected in this note. There is a workaround explained in KBA 3593336. CVSS v3 Base Score 10,0/ 10 [CVE-2025-31324]
2. Insecure Deserialization in SAP NetWeaver (Visual Composer development server) (3604119): SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system. Applying this note removes the deserialization, which completely resolves this vulnerability. There is a workaround in KBA 3593336 CVSS v3 Base Score 9,1​/ 10 [CVE-2025-42999]
3. Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) (3578900): Multiple critical vulnerabilities including Blind XXE, XSS, Open Redirect, Information Disclosure, and Insecure Deserialization affect the Live Auction Cockpit component of SAP SRM due to the use of a deprecated Java Applet, and are resolved by removing the applet through updates to versions that use only DHTML, as detailed in SAP Notes 2369341, 2171391, and 1715441.  CVSS v3 Base Score 8,6/ 10 [CVE-2025-30018]
4. Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise (SCM Master Data Layer (MDL)) (3600859): A code injection vulnerability in SAP S/4HANA Cloud Private Edition or on-premise (SCM Master Data Layer) allows authenticated users to remotely replace ABAP programs due to missing input validation and authorization checks, and is resolved by deprecating the obsolete function module through a correction that disables its execution. CVSS v3 Base Score 8,3/ 10  [CVE-2025-43010]
5. Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW): (3586013):An information exposure vulnerability in Promotion Management Wizard (PMW) allows unauthorized access to restricted data due to the ability to launch certain executables, and is resolved by restricting unnecessary information for end users through the implementation of the provided patches. There is a workaround in the note. CVSS v3 Base Score 7,9/ 10  [CVE-2025-43000]
6. Missing Authorization Check in SAP Landscape Transformation (PCL Basis) (3591978): A missing authorization check in SAP Landscape Transformation’s PCL Basis module allows authenticated users to access restricted data, impacting confidentiality, and is resolved by enhancing the affected remote-enabled function modules with proper authorization checks as detailed in the provided correction instructions or support packages. There isn’t workaround for this note. CVSS v3 Base Score 7,7/ 10 [CVE-2025-43011]
7. Update – Missing Authorization check in SAP PDCE (3483344): A privilege escalation vulnerability in PDCE allows authenticated users to access sensitive information due to missing authorization checks, and is resolved in version 19 by deactivating the affected functions and providing updated correction instructions for SEM-BW 600 SP01 to SP015 to simplify implementation without complex prerequisites. There is not workaround. CVSS v3 Base Score 7,7/ 10 [CVE-2024-39592]

Reference links

Other references, from SAP and Onapsis (may):

SAP Security Patch Day – May 2025

SAP Patch Day: May 2025 – Onapsis

Resources affected