SAP_SE Vulnerabilities and Affected Products

Open in search

Vulnerabilities associated with SAP NetWeaver Application Server Java.

Products

Clear product

Showing 8 vulnerabilities on this page for SAP NetWeaver Application Server Java

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

CRLF Injection vulnerability in SAP NetWeaver Application Server Java

Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.

CWE-113CWE-436Feb 10, 2026
CVSS3.4v3.1EPSS0.164%PoCs0SignalsSTIX

Information Disclosure vulnerability in SAP NetWeaver Application Server Java

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access to sensitive application metadata. This results in a partial compromise of the confidentiality of the information without affecting the integrity or availability of the application server.

CWE-22Nov 11, 2025
CVSS5.3v3.1EPSS0.465%PoCs0SignalsSTIX

Missing Authentication check in SAP NetWeaver Application Server Java

SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the system.This vulnerability has a low impact on confidentiality and does not affect the integrity or availability of the server.

CWE-306Sep 9, 2025
CVSS5.3v3.1EPSS0.299%PoCs0SignalsSTIX

Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java

The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection against the wildcard hostname defined in the received certificate of remote TLS server. This might lead to the outbound connection being established to a possibly malicious remote TLS server and hence disclose information. Integrity and Availability are not impacted.

CWE-940Jul 8, 2025
CVSS3.5v3.1EPSS0.122%PoCs0SignalsSTIX

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java

User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting (XSS). This could enable an attacker to inject malicious payload that gets stored and executed when a user accesses the functionality, hence leading to information disclosure or unauthorized data modifications within the scope of victim�s browser. There is no impact on availability.

CWE-79Mar 11, 2025
CVSS5.4v3.1EPSS0.216%PoCs0SignalsSTIX

Information Disclosure vulnerability in SAP NetWeaver Application Server Java

SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML files are not entirely SAP-internal as they are deployed with the server. In such a scenario, sensitive information could be exposed without compromising its integrity or availability.

CWE-863Feb 11, 2025
CVSS4.3v3.1EPSS0.246%PoCs0SignalsSTIX

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.

CWE-79Feb 11, 2025
CVSS5.4v3.1EPSS0.264%PoCs1SignalsSTIX

Missing Authorization check in SAP NetWeaver Application Server Java

Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on confidentiality, integrity, and availability of the application.

CWE-862Jan 14, 2025
CVSS6.3v3.1EPSS0.257%PoCs0SignalsSTIX