SAP SE SAP NetWeaver
At a glance
- Source
- NVD
- EPSS
- EPSS 1.67 % · percentile 77 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Modified
Description
SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials.
Weaknesses (CWE)
- CWE-94 — Improper Control of Generation of Code
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-14218
- GCVE · GCVE-0-2018-2363
Affected configurations (NVD CPE)
cpe:2.3:a:sap:netweaver:-:*:*:*:*:*:*:*cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*≥ 7.00 ≤ 7.02cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*≥ 7.10 ≤ 7.11cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*≥ 7.50 ≤ 7.52cpe:2.3:a:sap:business_application_software_integrated_solution:7.30:*:*:*:*:*:*:*cpe:2.3:a:sap:business_application_software_integrated_solution:7.31:*:*:*:*:*:*:*cpe:2.3:a:sap:business_application_software_integrated_solution:7.40:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP SE · SAP NetWeaver | affected 7.00 ; affected 7.02 ; affected 7.10 ; affected 7.11 ; affected 7.30 ; affected 7.31 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |