Netweaver Application Server For Java vulnerabilities

Product

Netweaver Application Server For Java

by Sap · last CVE Jul 11, 2023

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities9 In the news0 Timeline

Severity mix

Critical 2High 2Medium 5Low 0

Severity

All severities9 Critical2 High2 Medium5 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Netweaver Application Server For Java to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-0017	9.8	16%	Jan 10	An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and… Affected: 7.50
CVE-2023-30744	9.1	1%	May 9	In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use of an open naming… Affected: 7.50
CVE-2023-23857	8.6	1%	Mar 14	Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and… Affected: 7.50
CVE-2022-27669	7.5	1%	Apr 12	An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be restricted Affected: 7.50
CVE-2021-27635	6.5	2%	Jun 9	SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a specially crafted… Affected: 7.20; 7.30; 7.31; 7.40; 7.50
CVE-2023-31405	5.3	0%	Jul 11	SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in… Affected: 7.50
CVE-2023-27268	5.3	0%	Mar 14	SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open… Affected: 7.50
CVE-2023-26460	5.3	0%	Mar 14	Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that require user identity Affected: 7.50
CVE-2021-27621	4.9	1%	Jun 9	Information Disclosure vulnerability in UserAdmin application in SAP NetWeaver Application Server for Java, versions - 7.11,7.20,7.30,7.31,7.40 and 7.50 allows attackers to access… Affected: 7.11; 7.20; 7.30; 7.31; 7.40; 7.50