RCE in Sap Se Erp Bw Business Content
CVE-2025-30013
SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privileges, improperly handle user input, allowing attacker to inject arbitrary OS commands. This vulnerability allows the execution of unintended commands on the underlying system, posing a significant security risk to the confidentiality, integrity and availability of the application.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.008 (52.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Sap_se Sap Erp Bw Business Content — versions BI_CONT 707, 737, 747
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-30013?
- CVE-2025-30013 is a medium-severity vulnerability in Sap Se Erp Bw Business Content, classified under Code Injection. CVSS score: 6.7/10. Published 2025-04-08.
- How severe is CVE-2025-30013?
- Medium severity. CVSS v3 base score is 6.7 out of 10.