certfr_avis - certfr-2025-avi-0350

CERTFR-2025-AVI-0350

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans SAP NetWeaver. Elle permet à un attaquant de provoquer une atteinte à l'intégrité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'éditeur indique que la vulnérabilité CVE-2025-31324 est activement exploitée.

Cette information est disponible sur la foire aux questions relative à cette vulnérabilité [1]. L'accès à ce lien nécessite un compte utilisateur pour le support SAP.

Cette vulnérabilité, ajoutée au bulletin de sécurité SAP du 08 avril 2025, nécessite un correctif disponible depuis le 22 avril 2025. La mise à jour du 08 avril 2025 ne semble donc pas couvrir cette vulnérabilité.

Impacted products

	Vendor	Product	Description
	SAP	N/A	NetWeaver (Visual Composer development server) versions VCFRAMEWORK 7.50 sans le dernier correctif de sécurité

References

Title

Publication Time

Tags

Bulletin de sécurité SAP april-2025	2025-04-08	vendor-advisory
[1] FAQ sur l'exploitation de la vulnérabilité CVE-2025-31324	-	other
Avis CERTFR-2025-AVI-0285 du 08 avril 2025	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NetWeaver (Visual Composer development server) versions VCFRAMEWORK 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur indique que la vuln\u00e9rabilit\u00e9 CVE-2025-31324 est activement exploit\u00e9e. \n\nCette information est disponible sur la foire aux questions relative \u00e0 cette vuln\u00e9rabilit\u00e9  [1]. L\u0027acc\u00e8s \u00e0 ce lien n\u00e9cessite un compte utilisateur pour le support SAP. \n\nCette vuln\u00e9rabilit\u00e9, ajout\u00e9e au bulletin de s\u00e9curit\u00e9 SAP du 08 avril 2025, n\u00e9cessite un correctif disponible depuis le 22 avril 2025. La mise \u00e0 jour du 08 avril 2025 ne semble donc pas couvrir cette vuln\u00e9rabilit\u00e9.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-31324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31324"
    }
  ],
  "initial_release_date": "2025-04-25T00:00:00",
  "last_revision_date": "2025-05-19T00:00:00",
  "links": [
    {
      "title": "[1] FAQ sur l\u0027exploitation de la vuln\u00e9rabilit\u00e9 CVE-2025-31324",
      "url": "https://me.sap.com/notes/3596125"
    },
    {
      "title": "Avis CERTFR-2025-AVI-0285 du 08 avril 2025",
      "url": "https://cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-0285/"
    }
  ],
  "reference": "CERTFR-2025-AVI-0350",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-04-25T00:00:00.000000"
    },
    {
      "description": "Correction dune r\u00e9p\u00e9tition dans la source.",
      "revision_date": "2025-05-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans SAP NetWeaver. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Vuln\u00e9rabilit\u00e9 dans SAP NetWeaver",
  "vendor_advisories": [
    {
      "published_at": "2025-04-08",
      "title": "Bulletin de s\u00e9curit\u00e9 SAP april-2025",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2025.html"
    }
  ]
}

CVE-2025-31324 (GCVE-0-2025-31324)

Vulnerability from cvelistv5

Published

2025-04-24 16:50

Modified

2025-10-21 22:55

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Summary

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

References

URL

Tags

	https://me.sap.com/notes/3594142
	https://url.sap/sapsecuritypatchday

Impacted products

	Vendor	Product	Version
	SAP_SE	SAP NetWeaver (Visual Composer development server)	Version: VCFRAMEWORK 7.50

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-31324",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-30T03:56:21.966706Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-04-29",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:55:17.980Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "technical-description"
            ],
            "url": "https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-04-29T00:00:00+00:00",
            "value": "CVE-2025-31324 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-05-02T17:13:30.650Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.theregister.com/2025/04/25/sap_netweaver_patch/"
          },
          {
            "url": "https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/"
          },
          {
            "url": "https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver (Visual Composer development server)",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "VCFRAMEWORK 7.50"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.\u003c/p\u003e"
            }
          ],
          "value": "SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-24T16:50:27.706Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3594142"
        },
        {
          "url": "https://url.sap/sapsecuritypatchday"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing Authorization check in SAP NetWeaver (Visual Composer development server)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2025-31324",
    "datePublished": "2025-04-24T16:50:27.706Z",
    "dateReserved": "2025-03-27T23:02:06.906Z",
    "dateUpdated": "2025-10-21T22:55:17.980Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2025-AVI-0350

Vulnerability from certfr_avis

Solutions

CVE-2025-31324 (GCVE-0-2025-31324)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature