{"basis":"claimed","id":"CVE-2025-31324","name":"SAP NetWeaver Unrestricted File Upload Vulnerability","vendorProject":"SAP","product":"NetWeaver","publishedAt":"2025-04-24","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2025-04-29","dueDate":"2025-05-20","ransomware":true},"epss":{"score":0.99486,"percentile":0.99945,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-05-27","daysToRule":33},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-05-22","daysToRule":28},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Missing Authorization check in SAP NetWeaver (Visual Composer development server)","description":"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.","cwes":["CWE-434"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-05-27","firstIsNew":true,"daysToRule":33,"daysAtMost":null,"freePlan":false,"claims":[{"id":"084d06a5cafd1c22fb22f5484f4fce8546bcaf29b2e411dcb6b99f55a1a54ac3","cve_id":"CVE-2025-31324","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"bd30b3c43eb44335ab6013c195442495","rule_name":"SAP NetWeaver - Dangerous File Upload - CVE:CVE-2025-31324","change":"new","default_action":"Block","published_on":"2025-05-27","source_url":"https://developers.cloudflare.com/changelog/post/2025-05-27-waf-release/","source_title":"WAF Release - 2025-05-27","excerpt":"SAP NetWeaver - Dangerous File Upload - CVE:CVE-2025-31324. Previous action: Log. New action: Block. This is a New Detection","first_seen_at":"2026-11-02T21:00:16.558Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-05-22","firstIsNew":true,"daysToRule":28,"daysAtMost":null,"freePlan":false,"claims":[{"id":"c12d0b8a9a8d186fd4ff63e3e1604af832f6e604a431ec135983c3d877220890","cve_id":"CVE-2025-31324","vendor":"f5","product":"Attack signatures","rule_id":"200020225","rule_name":"SAP NetWeaver Arbitrary File Upload","change":"new","default_action":null,"published_on":"2025-05-22","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200020225 \"SAP NetWeaver Arbitrary File Upload\" (Malicious File Upload, risk High), systems: Other Web Server. References: CVE-2025-31324.","first_seen_at":"2026-11-02T21:00:26.263Z"},{"id":"db7853e9027f5347692fbbd8cc721227d2657bc62db692f5f49be51bb55a0a8e","cve_id":"CVE-2025-31324","vendor":"f5","product":"Attack signatures","rule_id":"200020225","rule_name":"SAP NetWeaver Arbitrary File Upload (1)","change":"updated","default_action":null,"published_on":"2025-06-30","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Updated: signature 200020225 \"SAP NetWeaver Arbitrary File Upload (1)\" (Malicious File Upload, risk High), systems: Other Web Server. References: CVE-2025-31324.","first_seen_at":"2026-11-02T21:00:25.890Z"},{"id":"fe93b39fc00bff504ed2cf533425952697871d447165307f5a30f8f93b9f0c15","cve_id":"CVE-2025-31324","vendor":"f5","product":"Attack signatures","rule_id":"200020226","rule_name":"SAP NetWeaver Arbitrary File Upload (2)","change":"new","default_action":null,"published_on":"2025-06-30","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200020226 \"SAP NetWeaver Arbitrary File Upload (2)\" (Malicious File Upload, risk High), systems: Java Servlets/JSP. References: CVE-2025-31324.","first_seen_at":"2026-11-02T21:00:25.890Z"},{"id":"7087a116850bb58ad54c17f8f78ebec9c293bc83bc36feb0178f7c2ce882efe8","cve_id":"CVE-2025-31324","vendor":"f5","product":"Attack signatures","rule_id":"200020227","rule_name":"SAP NetWeaver Arbitrary File Upload (3)","change":"new","default_action":null,"published_on":"2025-06-30","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200020227 \"SAP NetWeaver Arbitrary File Upload (3)\" (Malicious File Upload, risk High), systems: Java Servlets/JSP. References: CVE-2025-31324.","first_seen_at":"2026-11-02T21:00:25.890Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:41.517Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"blocked","templateId":"CVE-2025-31324","templatePath":"http/cves/2025/CVE-2025-31324.yaml","requests":1,"blockedRequests":1,"rules":["200002"],"note":"","requestDetail":[{"method":"POST","path":"/developmentserver/metadatauploader?…","status":400,"blocked":true,"rules":["200002"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2025-31324","templatePath":"http/cves/2025/CVE-2025-31324.yaml","requests":1,"blockedRequests":1,"rules":["200002"],"note":"","requestDetail":[{"method":"POST","path":"/developmentserver/metadatauploader?…","status":400,"blocked":true,"rules":["200002"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}