CVE-2025-30009 — Cross-site Scripting in SE SAP Supplier Relationship Management

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.5%
top 35.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Supplier Relationship ManagementSAP Supplier Relationship Management
Timeline
PublishedMay 13

Description

he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to execute malicious script in the victim�s browser. This vulnerability has low impact on confidentiality and integrity within the scope of that victim�s browser, with no effect on availability of the application

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)↗2025-05-13
▶
GHSA
GHSA-j2cw-3q46-v5jg: he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which a↗2025-05-13
▶
CVE-2025-30009 — Cross-site Scripting | cvebase