Sap Netweaver vulnerabilities, page 5

98 vulnerabilities

Known vulnerabilities in Sap Netweaver, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.3MediumCVE-2010-1609sap · netweaversap netweaverCross-site scripting (XSS) vulnerability in SAP NetWeaver 2004 before SP21 and 2004s before SP13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.EPSS1.03%7.8HighCVE-2017-9845sap · netweaversap netweaverdisp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request, aka SAP Security Note 2405918.EPSS2.50%7.5HighCVE-2017-9844sap · netweaversap netweaverSAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer deserializes a malicious object that may cause legitimate users accessing a service, either by crashing or flooding the service.EPSS5.37%5.3MediumCVE-2024-25644sap_se · netweaver (wsrm) +1 moreInformation Disclosure vulnerability in NetWeaver (WSRM)Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application.EPSS0.41%5.3MediumCVE-2024-27898sap_se · sap netweaver +1 moreServer-Side Request Forgery in SAP NetWeaverSAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. Thus, having a low impact on confidentiality.EPSS0.45%7.5HighCVE-2024-22124sap_se · sap netweaver (internet communication manager) +1 moreInformation Disclosure vulnerability in SAP NetWeaver Internet Communication ManagerUnder certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53, WEBDISP 7.54, could allow an attacker to access information which would otherwise be restricted causing high impact on confidentiality.EPSS0.33%4.3MediumCVE-2009-2932sap · netweaversap netweaverCross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remote attackers to inject arbitrary web script or HTML via the TModel Key field.EPSS2.06%8.8HighCVE-2019-0351sap se · sap netweaver uddi server (services registry) +1 moresap se sap netweaver uddi server (services registry)A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50. Because of this, an attacker can exploit Services Registry potentially enabling them to take complete control of the product, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the product to terminate.EPSS2.51%5.9MediumCVE-2019-0248sap se · sap gateway of abap application server(sap_basis) +3 moresap se sap gateway of abap application server(sap_basis)Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would otherwise be restricted.EPSS1.56%4.4MediumCVE-2026-23685sap_se · sap netweaver (jms service) +1 moreInsecure Deserialization vulnerability in SAP NetWeaver (JMS service)Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during internal logic execution, potentially causing a denial of service. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.EPSS0.15%5.3MediumCVE-2023-41367sap_se · sap netweaver (guided procedures) +1 moreMissing Authentication check in SAP NetWeaver (Guided Procedures)Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admin view of specific function anonymously. On successful exploitation of vulnerability under specific circumstances, attacker can view user’s email address. There is no integrity/availability impact.EPSS0.55%6.1MediumCVE-2023-0021sap_se · sap netweaver +1 moreCross-Site Scripting (XSS) vulnerability in SAP NetWeaverDue to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.EPSS0.46%9.1CriticalCVE-2023-36922sap_se · sap ecc and sap s/4hana (is-oil) +1 moreOS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension.  On successful exploitation, the attacker can read or modify the system data as well as shut down the system.EPSS0.84%8.7HighCVE-2023-29186sap · netweaver +1 moreDirectory/Path Traversal vulnerability in SAP NetWeaver.In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.EPSS23.04%6.1MediumCVE-2023-27499sap_se · gui for html +2 moreCross-Site Scripting (XSS) vulnerability in SAP GUI for HTMLSAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user's browser. The information from the victim's web browser can either be modified or read and sent to the attacker.EPSS0.45%2.7LowCVE-2023-32114sap_se · sap netweaver (change and transport system) +1 moreDenial of Service in SAP NetWeaverSAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application.EPSS0.60%6.1MediumCVE-2023-33985sap_se · sap netweaver enterprise portal +1 moreCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalSAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.EPSS0.51%6.4MediumCVE-2023-33984sap_se · sap netweaver (design time repository) +1 moreCross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository)SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email or instant message. Under certain circumstances, this could lead to Cross-Site Scripting vulnerability.EPSS0.40%