Unscored severity · published Apr 10, 2014
CVE-2013-7364
An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via…
–
CVSS
1.5%
EPSS
No
On KEV
Description
An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netweaver · Sap
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-7364
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-7364
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2013-02/0133.html
scn.sap.com
http://scn.sap.com/docs/DOC-8218
www.onapsis.com
http://www.onapsis.com/get.php?resid=adv_onapsis-2013-004
www.onapsis.com
http://www.onapsis.com/research-advisories.php
service.sap.com
https://service.sap.com/sap/support/notes/1682613
More from Netweaver
10.0
CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
10.0
CVE-2010-5326
SAP NetWeaver Remote Code Execution Vulnerability
9.8
CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
9.8
CVE-2016-2386
SAP NetWeaver SQL Injection Vulnerability
9.1
CVE-2025-42999
Insecure Deserialization in SAP NetWeaver (Visual Composer development server)