by Kastro
Paper/Archive/CVE-2023-27269

CVE-2023-27269

SAP NetWeaver Application Server for ABAP and ABAP Platform — Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

EPSS 1.0%CVSS 9.6
critical.is priorityof 100
41
CVSS 9.6 (NVD, CNA agree)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 62.3.623 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files.  In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.

Affected

ProductAffectedFixed inSource
NetWeaver Application Server for ABAP and ABAP Platform700–CNA
NetWeaver Application Server for ABAP and ABAP Platform701–CNA
NetWeaver Application Server for ABAP and ABAP Platform702–CNA
NetWeaver Application Server for ABAP and ABAP Platform731–CNA
NetWeaver Application Server for ABAP and ABAP Platform740–CNA
NetWeaver Application Server for ABAP and ABAP Platform750–CNA
NetWeaver Application Server for ABAP and ABAP Platform751–CNA
NetWeaver Application Server for ABAP and ABAP Platform752–CNA
NetWeaver Application Server for ABAP and ABAP Platform753–CNA
NetWeaver Application Server for ABAP and ABAP Platform754–CNA
NetWeaver Application Server for ABAP and ABAP Platform755–CNA
NetWeaver Application Server for ABAP and ABAP Platform756–CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
sap (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

reflaunchpad.support.sap.com/#/notes/3294595refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html