Netweaver Application Server Abap vulnerabilities
15 known vulnerabilities in Netweaver Application Server Abap from SAP. 15 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.9 Critical severity
SAP CRM and SAP S/4HANA (Scripting Editor): Missing Authorization
An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a
- 8.1 High severity
SAP NetWeaver Application Server ABAP and ABAP…: Missing Authorization
Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to wri
- 9.4 Critical severity
SAP NetWeaver Application Server ABAP and ABAP…: Improper Neutralization of Special Elements used in an SQL Command
SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doi
- 9.8 Critical severity
SAP CommonCryptoLib: Incorrect Authorization
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired,
- 7.5 High severity
SAP CommonCryptoLib: Out-of-bounds Write
SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view
- 7.4 High severity
SAP NetWeaver AS ABAP and ABAP Platform: Missing Authentication for Critical Functionality
SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNE
- 9.6 Critical severity
NetWeaver AS for ABAP and ABAP Platform: Improper Limitation of a Pathname to a Restricted Directory
SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw
- 8.1 High severity
NetWeaver AS for ABAP and ABAP Platform…: Improper Limitation of a Pathname to a Restricted Directory
An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. In this attack, no data can be read but potentially critical OS files can be over-written making the system unavailable.
- 9.6 Critical severity
NetWeaver Application Server for ABAP and ABAP…: Improper Limitation of a Pathname to a Restricted Directory
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service
- 7.4 High severity
NetWeaver AS for ABAP and ABAP Platform: Server-Side Request Forgery
Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, an attacker authenticated as a non-administrative user can craft a request which will trigger the app
- 9.8 Critical severity
NetWeaver ABAP Server and ABAP Platform: Authentication Bypass by Capture-replay
SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates informati
- 8.7 High severity
Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform…
Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to delete a file which is otherwise restricted. On successful exploitation an attacker
- 8.8 High severity
SAP NetWeaver Application Server for ABAP and…: Missing Authorization
SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- 7.5 High severity
SAP NetWeaver AS ABAP (Workplace Server): Improper Neutralization of Special Elements used in an SQL Command
SAP NetWeaver AS ABAP (Workplace Server) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, allows an attacker to execute crafted database queries, that could expose the backend database. Successful attacks could result in disclosure o
- 10.0 Critical severity
SAP Multiple Products HTTP Request Smuggling Exploited
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's reque