SAP SE SAP NetWeaver
En bref
- Source
- NVD
- EPSS
- EPSS 1.67 % · centile 77 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Modified
Rechercher sur…
Description
SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials.
Faiblesses (CWE)
- CWE-94 — Injection de code
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-14218
- GCVE · GCVE-0-2018-2363
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:netweaver:-:*:*:*:*:*:*:*cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*≥ 7.00 ≤ 7.02cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*≥ 7.10 ≤ 7.11cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*≥ 7.50 ≤ 7.52cpe:2.3:a:sap:business_application_software_integrated_solution:7.30:*:*:*:*:*:*:*cpe:2.3:a:sap:business_application_software_integrated_solution:7.31:*:*:*:*:*:*:*cpe:2.3:a:sap:business_application_software_integrated_solution:7.40:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP SE · SAP NetWeaver | affected 7.00 ; affected 7.02 ; affected 7.10 ; affected 7.11 ; affected 7.30 ; affected 7.31 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |