[Vulnerability Alert] Security Vulnerability in NetWeaver (CVE-2025-31324) – Immediate Verification and Patching Recommended
publish date :
2025-05-20
update date :
2025-05-20
Source: Ministry of education information & communication security contingency platform
| Publication Number | TACERT-ANA-2025051309050707 | Publication Time | 2025/05/13 09:03 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2025/05/13 09:03 |
| Impact Level | Medium | ||
| [Subject] [Vulnerability Alert] Security Vulnerability in NetWeaver (CVE-2025-31324) – Immediate Verification and Patching Recommended |
|||
| [Content] Forwarded from the National Institute of Cyber Security NISAC-200-202505-00000027 Researchers have discovered an arbitrary file upload vulnerability (CVE-2025-31324) in the Visual Composer Metadata Uploader component of NetWeaver, which allows unauthenticated remote attackers to upload and execute malicious programs. This vulnerability has already been actively exploited by attackers. Immediate verification and patching is strongly advised. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] NetWeaver version 7.x |
|||
| [Recommended Actions] For version 7.5 and above: Patches SP027 to SP033 have been released. Installation is recommended. For versions 7.4 and below: It is advised to upgrade to version 7.5 or above and apply the relevant patches, or adopt mitigation measures. Official patches and mitigation guidelines have been released (login required): https://me.sap.com/notes/3594142 https://me.sap.com/notes/3596125/E https://me.sap.com/notes/3593336/E |
|||
| [Reference] 1. https://nvd.nist.gov/vuln/detail/CVE-2025-31324 2. https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ 3. https://securitybridge.com/blog/cve-2025-31324 4. https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/guidance-for-handling-cve-2025-31324-using-microsoft-security-capabilities/4409413 5. https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 |
|||
(This notification is for informational purposes only and does not constitute a cybersecurity incident).
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw
Organizer:
Computer Center
