Description
SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and also to access, modify or make unavailable existing files but the impact is limited to the files themselves and is restricted by other policies such as access control lists and other upload file size restrictions, leading to Unrestricted File Upload.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345
Permissions Required x_refsource_misc
https://launchpad.support.sap.com/#/notes/2938162
Scores
CVSS v3
6.5
EPSS
0.0031
EPSS Percentile
54.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Details
CWE
CWE-434
Status
published
Products (4)
sap/netweaver_knowledge_management
7.30
sap/netweaver_knowledge_management
7.31
sap/netweaver_knowledge_management
7.40
sap/netweaver_knowledge_management
7.50
Published
Aug 12, 2020
Tracked Since
Feb 18, 2026