Description
SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP_SE | SAP Supplier Relationship Management (Master Data Management Catalog) | SRM_MDM_CAT 7.52 | — |
Advisories 2
- NCSC-2025-0045 Kwetsbaarheden verholpen in SAP producten NCSC-NL (Netherlands) · Feb 11, 2025
- WID-SEC-2025-0307 SAP Patchday Februar 2025: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 10, 2025