Netweaver vulnerabilities
10 known vulnerabilities in Netweaver from SAP. 10 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
SAP NetWeaver Deserialization Exploited
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
- 9.8 Critical severity
SAP NetWeaver Unrestricted File Upload Exploited
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confi
- 7.5 High severity
SAP NetWeaver AS Java: Uncontrolled Resource Consumption
Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users from accessing it. This can result in no impact on confidentiality and integrity
- 9.6 Critical severity
SAP NetWeaver Application Server ABAP and ABAP…: Unrestricted Upload of File with Dangerous Type
An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.
- 9.1 Critical severity
SAP NetWeaver AS Java (Administrator Log…: Improper Neutralization of Special Elements used in a Command
SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands
- 7.5 High severity
SAP NetWeaver (Internet Communication Manager): Exposure of Sensitive System Information to an Unauthorized Control Sphere
Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53, WEBDISP 7
- 8.8 High severity
SAP ECC and SAP S/4HANA (IS-OIL): Improper Neutralization of Special Elements used in an OS Command
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful ex
- 7.5 High severity
SAP NetWeaver (Internet Communication Manager): Uncontrolled Recursion
Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically.
- 7.5 High severity
SAP NetWeaver (Internet Communication Manager): Out-of-bounds Write
By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Internet Communication Manager - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53
- 8.8 High severity
SAP NetWeaver Unrestricted File Upload Exploited
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating s