CVE-2025-25243 — Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)

CVE-2025-25243

Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog) PUBLISHED

Description (CNA)

SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Supplier Relationship Management (Master Data Management Catalog)	affected SRM_MDM_CAT 7.52

CWE

CWE-22

References

https://me.sap.com/notes/3567551
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.