CVE-2025-25243

High

Published: 11 February 2025

Published

11 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS Score 0.0026 49.3th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25243 is a high-severity Path Traversal (CWE-22) vulnerability in Sap (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-14 (Public Access Protections) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-25243 is a path traversal vulnerability (CWE-22) in SAP Supplier Relationship Management (Master Data Management Catalog). It enables an unauthenticated attacker to exploit a publicly available servlet to download arbitrary files over the network without user interaction. The issue exposes highly sensitive information, with no impact on integrity or availability, and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

An unauthenticated remote attacker can exploit this vulnerability by sending crafted requests to the affected servlet, achieving arbitrary file read access on the server. Successful exploitation grants access to sensitive data such as configuration files, credentials, or other critical information, potentially leading to further compromise in the SAP environment. The low attack complexity and lack of prerequisites make it highly accessible to threat actors scanning for exposed SAP instances.

SAP has addressed this vulnerability through security note 3567551, available at https://me.sap.com/notes/3567551, as part of their SAP Security Patch Day detailed at https://url.sap/sapsecuritypatchday. Security practitioners should apply the recommended patches promptly to mitigate the risk of unauthorized file disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-4094

Vulnerability details

SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to…

integrity or availability.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

The path traversal in a public-facing SAP servlet directly enables T1190 (Exploit Public-Facing Application) for unauthenticated remote file access and facilitates T1005 (Data from Local System) by allowing arbitrary file reads including sensitive data like credentials.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0