Login Request a demo
Critical severity · published May 13, 2016
CVE-2010-5326
SAP NetWeaver Remote Code Execution Vulnerability
In wildKEV
10.0
CVSS
17.8%
EPSS
Yes
On KEV
Description
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)17.8% · higher than 97% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
NA
Netweaver Application Server Java · Sap
through 7.30 · source: NVD
NE
NetWeaver · SAP
All versions, or not specified · source: KEV
Affected product
NA
Netweaver Application Server Java
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-5326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-5326
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vdb-entry
http://www.securityfocus.com/bid/90533
x_refsource_MISC
https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications
x_refsource_MISC
http://service.sap.com/sap/support/notes/1445998
x_refsource_MISC
http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions
third-party-advisory
http://www.us-cert.gov/ncas/alerts/TA16-132A
vdb-entry
http://www.securityfocus.com/bid/48925
More from Netweaver Application Server Java
10.0
CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
9.8
CVE-2016-2386
SAP NetWeaver SQL Injection Vulnerability
7.5
CVE-2017-12637
SAP NetWeaver Directory Traversal Vulnerability
7.5
CVE-2016-3976
SAP NetWeaver Directory Traversal Vulnerability
6.5
CVE-2016-9563
SAP NetWeaver XML External Entity (XXE) Vulnerability