by Kastro
Paper/Archive/CVE-2023-27501

CVE-2023-27501

SAP NetWeaver AS for ABAP and ABAP Platform — Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

EPSS 1.0%CVSS 9.6
critical.is priorityof 100
41
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 62.1.621 × 2012.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw in an available service to delete system files. In this attack, no data can be read but potentially critical OS files can be deleted making the system unavailable, causing significant impact on both availability and integrity

Affected

ProductAffectedFixed inSource
NetWeaver AS for ABAP and ABAP Platform700–CNA
NetWeaver AS for ABAP and ABAP Platform701–CNA
NetWeaver AS for ABAP and ABAP Platform702–CNA
NetWeaver AS for ABAP and ABAP Platform731–CNA
NetWeaver AS for ABAP and ABAP Platform740–CNA
NetWeaver AS for ABAP and ABAP Platform750–CNA
NetWeaver AS for ABAP and ABAP Platform751–CNA
NetWeaver AS for ABAP and ABAP Platform752–CNA
NetWeaver AS for ABAP and ABAP Platform753–CNA
NetWeaver AS for ABAP and ABAP Platform754–CNA
NetWeaver AS for ABAP and ABAP Platform755–CNA
NetWeaver AS for ABAP and ABAP Platform756–CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
sap (CNA)8.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reflaunchpad.support.sap.com/#/notes/3294954refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html