CVE-2025-30009: Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
Description
he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to execute malicious script in the victim�s browser. This vulnerability has low impact on confidentiality and integrity within the scope of that victim�s browser, with no effect on availability of the application
Classification
CVE ID: CVE-2025-30009
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.1
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
Vendor: SAP_SE
Product: SAP Supplier Relationship Management (Live Auction Cockpit)
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.08% (probability of being exploited)
EPSS Percentile: 24.81% (scored less or equal to compared to others)
EPSS Date: 2025-06-11 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact: partial
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2025-30009https://me.sap.com/notes/3578900
https://url.sap/sapsecuritypatchday