CVE-2025-30011: SAP SRM Information Disclosure Flaw

CVE-2025-30011 Overview

CVE-2025-30011 affects the Live Auction Cockpit in SAP Supplier Relationship Management (SRM). The component relies on a deprecated Java applet that responds to unauthenticated requests. An attacker on the network can query the application and retrieve internal version details of the affected system. This information disclosure weakness is classified under [CWE-497] (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The flaw has low impact on confidentiality and no impact on integrity or availability. SAP addressed the issue in the May 2025 Security Patch Day advisory via SAP Note #3578900.

Critical Impact
Unauthenticated remote attackers can enumerate internal SAP SRM version details, aiding reconnaissance for follow-on attacks against the ERP stack.

Affected Products

SAP Supplier Relationship Management (SRM) 7.14
SAP SRM Live Auction Cockpit component (deprecated Java applet)
SAP SRM packages bundling the vulnerable applet

Discovery Timeline

2025-05-13 - CVE-2025-30011 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30011

Vulnerability Analysis

The Live Auction Cockpit in SAP SRM ships a deprecated Java applet component that processes requests without requiring authentication. When the applet receives a crafted request, it returns internal metadata that identifies the running version of the SRM stack. Attackers reach the endpoint over the network with no privileges and no user interaction. The disclosed data does not modify records or interrupt service, but it narrows an attacker's search for version-specific exploits against SAP SRM. EPSS data lists a probability of 0.316% at the 23.7 percentile, and no public exploit or CISA KEV listing exists as of publication.

Root Cause

The root cause is the continued deployment of a deprecated Java applet inside SRM 7.14 packages. The applet responds to unauthenticated version-probe requests instead of restricting metadata to authenticated administrators. This design choice maps to [CWE-497] because sensitive product information leaves an unauthorized control sphere.

Attack Vector

Exploitation requires only network reachability to the SRM application. An attacker sends a malicious HTTP request to the Live Auction Cockpit applet endpoint. The server responds with internal version details that expose the SRM release, patch level, and related build metadata. No credentials, no user interaction, and no elevated privileges are needed. Attackers typically use this information to select matching exploits for other SAP vulnerabilities affecting the disclosed version. Refer to the SAP Security Patch Day advisory and SAP Note #3578900 for vendor-provided technical details.

Detection Methods for CVE-2025-30011

Indicators of Compromise

Unauthenticated HTTP requests targeting the Live Auction Cockpit applet paths on SAP SRM 7.14 hosts.
Response payloads from SRM endpoints containing internal build or version strings returned to unauthenticated clients.
Repeated version-probe traffic from a single external source against SRM application servers.

Detection Strategies

Inspect SAP Web Dispatcher and ICM access logs for unauthenticated requests to Live Auction Cockpit URLs.
Correlate reconnaissance patterns targeting SRM version endpoints with subsequent exploitation attempts against SAP components.
Alert on anomalous external client fingerprints (non-browser user agents) requesting Java applet resources on SRM.

Monitoring Recommendations

Forward SAP SRM application and Web Dispatcher logs to a centralized SIEM for baseline analysis.
Monitor egress of version banner responses from SRM to untrusted network segments.
Track SAP OSS Note compliance status across SRM instances to confirm SAP Note #3578900 has been applied.

How to Mitigate CVE-2025-30011

Immediate Actions Required

Apply the fix documented in SAP Note #3578900 to all SAP SRM 7.14 systems.
Restrict network exposure of the Live Auction Cockpit to internal, authenticated users through firewall or reverse-proxy rules.
Inventory all SRM instances and confirm which still ship the deprecated Java applet component.

Patch Information

SAP released the corrective patch on May 2025 Security Patch Day. Customers must apply the SRM package updates referenced in SAP Note #3578900 and validate the fix through SAP EarlyWatch or the System Recommendations service. Details are also indexed on the SAP Security Patch Day portal.

Workarounds

Disable or remove the deprecated Live Auction Cockpit Java applet if the business does not rely on it.
Block unauthenticated access to the applet endpoint at the SAP Web Dispatcher or upstream load balancer.
Enforce network segmentation so that only authorized procurement users can reach SRM application servers.

bash

# Configuration example: SAP Web Dispatcher rule to block unauthenticated Live Auction Cockpit paths
# Add to icm/HTTP/mod_0 profile parameter or dispatcher rewrite rules
if %{PATH} stricmp /sap/bc/gui/sap/its/bbpglobal
  RegRewriteResponse ^.*$ "Access Denied" [status=403]
if %{PATH} regimatch ^/sap/srm/lac/.*
  RegIRedirectUrl ^.*$ /denied [status=403]