CVE-2025-25243
Published: 11 February 2025
Description
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Security Summary
CVE-2025-25243 is a path traversal vulnerability (CWE-22) in SAP Supplier Relationship Management (Master Data Management Catalog). It enables an unauthenticated attacker to exploit a publicly available servlet to download arbitrary files over the network without user interaction. The issue exposes highly sensitive information, with no impact on integrity or availability, and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
An unauthenticated remote attacker can exploit this vulnerability by sending crafted requests to the affected servlet, achieving arbitrary file read access on the server. Successful exploitation grants access to sensitive data such as configuration files, credentials, or other critical information, potentially leading to further compromise in the SAP environment. The low attack complexity and lack of prerequisites make it highly accessible to threat actors scanning for exposed SAP instances.
SAP has addressed this vulnerability through security note 3567551, available at https://me.sap.com/notes/3567551, as part of their SAP Security Patch Day detailed at https://url.sap/sapsecuritypatchday. Security practitioners should apply the recommended patches promptly to mitigate the risk of unauthorized file disclosure.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The path traversal in a public-facing SAP servlet directly enables T1190 (Exploit Public-Facing Application) for unauthenticated remote file access and facilitates T1005 (Data from Local System) by allowing arbitrary file reads including sensitive data like credentials.