CVE Watch—

CVE-2025-31324

SAP NetWeaver Unrestricted File Upload Vulnerability

CVSS

—

Sin CVSS

EPSS

99.4%

p100

KEV

SÍ

29 abr 2025

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

99.4%EPSS · 30 días99.4%

2026-06-302026-07-16

Ficha del catálogo KEV

Producto

SAP / NetWeaver

Vulnerabilidad

SAP NetWeaver Unrestricted File Upload Vulnerability

Añadido a KEV

29 abr 2025

Remediar antes de

20 may 2025

Uso conocido en ransomware

Sí

Descripción resumida

SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://me.sap.com/notes/3594142 ; https://nvd.nist.gov/vuln/detail/CVE-2025-31324

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2020-6287—

99.8%

KEV—80SAP NetWeaver Missing Authentication for Critical Function Vulnerability—CVE-2017-12637—

99.8%

KEV—80SAP NetWeaver Directory Traversal Vulnerability—CVE-2016-2386—

99.3%

KEV—80SAP NetWeaver SQL Injection Vulnerability—CVE-2016-2388—

98.8%

KEV—80SAP NetWeaver Information Disclosure Vulnerability—CVE-2016-3976—

98.7%

KEV—80SAP NetWeaver Directory Traversal Vulnerability—CVE-2021-38163—

98.3%

KEV—79SAP NetWeaver Unrestricted File Upload Vulnerability—