Executive brief
SAP NetWeaver Visual Composer Metadata Uploader lacks proper authorization, allowing unauthenticated remote attackers to upload malicious executable binaries. This unrestricted file upload vulnerability can lead to full system compromise, affecting confidentiality, integrity, and availability.
Affected products
- SAP SE NetWeaver Visual Composer Metadata Uploader 7.50
Timeline
- 2025-04-24: disclosed: Initial disclosure by SAP SE
- 2025-04-25: other: Media reports of suspected zero-day exploitation
- 2025-04-29: kev added: Added to CISA Known Exploited Vulnerabilities Catalog