SAP Vulnerabilities and Affected Products
Vulnerabilities associated with netweaver_application_server_java.
Products
Clear product- NetWeaver19 vulnerabilities
- NetWeaver AS for ABAP and ABAP Platform7 vulnerabilities
- SAP BusinessObjects Business Intelligence Platform5 vulnerabilities
- SAP Fiori Client5 vulnerabilities
- commerce_cloud4 vulnerabilities
- Solution Manager4 vulnerabilities
- BusinessObjects Business Intelligence Platform (Web Services)3 vulnerabilities
- NetWeaver Application Server for ABAP and ABAP Platform3 vulnerabilities
- NetWeaver AS ABAP (BSP Framework)3 vulnerabilities
- NetWeaver AS for Java3 vulnerabilities
- SAP BusinessObjects Business Intelligence3 vulnerabilities
- SAP HANA extended application services3 vulnerabilities
- SAP Internet Graphics Server (IGS)3 vulnerabilities
- Application Interface Framework (Message Dashboard)2 vulnerabilities
- Business Planning and Consolidation2 vulnerabilities
- business_objects_business_intelligence_platform2 vulnerabilities
- commerce_hycom2 vulnerabilities
- CRM (WebClient UI)2 vulnerabilities
- NetWeaver Process Integration2 vulnerabilities
- netweaver_application_server_java2 vulnerabilities
- SAP Adaptive Server Enterprise (ASE)2 vulnerabilities
- SAP BusinessObjects Business Intelligence Suite2 vulnerabilities
- SAP Enterprise Financial Services2 vulnerabilities
- SAP HANA2 vulnerabilities
- SAP NetWeaver AS Java (ServerCore)2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-47592MEDIUM | Information Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application)SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impact on confidentiality but not on integrity or availability. CWE-307Nov 12, 2024 | CVSS5.3v3.1 | EPSS0.298% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-6286MEDIUM | SAP netweaver_application_server_java Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal. CWE-22Jul 14, 2020 | CVSS5.3v3.1 | EPSS28.3% | PoCs3 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |