Netweaver Process Integration vulnerabilities | LiveThreat CVE Feed

Product

Netweaver Process Integration

by Sap · last CVE Mar 12, 2024

CVEs

On KEV

9.4

Max CVSS

New 30D

Vulnerabilities21 In the news0 Timeline

Severity mix

Critical 1High 4Medium 16Low 0

Severity

All severities21 Critical1 High4 Medium16 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Netweaver Process Integration to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2022-41271	9.4	1%	Dec 13	An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50 Affected: 7.50
CVE-2022-41272	8.6	1%	Dec 13	An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Integration (PI) -… Affected: 7.50
CVE-2019-0315	7.5	1%	Jun 12	Under certain conditions the PI Integration Builder Web UI of SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, SAP_XITOOL: 7.10… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2019-0328	7.2	3%	Jul 10	ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights Affected: 7.0; 7.1; 7.3; 7.4; 7.5; 7.31
CVE-2019-0283	7.1	1%	Apr 10	SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing Affected: 7.10; 7.11; 7.30; 7.31; 7.40; 7.50
CVE-2023-35873	6.5	1%	Jul 11	The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user… Affected: 7.50
CVE-2023-35872	6.5	1%	Jul 11	The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities that require user… Affected: 7.50
CVE-2021-27604	6.5	1%	Apr 14	In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA Mappings), versions… Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50
CVE-2021-27599	6.5	1%	Apr 14	SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, allows an attacker to access… Affected: 7.10; 7.30; 7.31; 7.40; 7.50
CVE-2023-37488	6.1	0%	Aug 8	In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could result in Cross-Site… Affected: 7.50
CVE-2019-0337	6.1	1%	Aug 14	Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to… Affected: 7.10; 7.11; 7.30; 7.31; 7.40; 7.50
CVE-2024-28163	5.3	0%	Mar 12	Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would otherwise be… Affected: 7.50
CVE-2019-0312	5.3	1%	Jun 12	Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50)… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2019-0282	5.3	1%	Apr 10	Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication,… Affected: 7.10; 7.11; 7.30; 7.31; 7.40; 7.50
CVE-2021-27618	4.9	1%	May 11	The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file type extension of the file uploaded from… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2021-27617	4.9	1%	May 11	The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document uploaded from… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2019-0316	4.8	1%	Jun 14	SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2019-0367	4.3	1%	Oct 8	SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B… Affected: 1.0; 2.0
CVE-2019-0356	4.3	1%	Sep 10	Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to access information… Affected: 7.31; 7.40; 7.50
CVE-2019-0305	4.3	1%	Jun 12	Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2019-0278	4.3	1%	Apr 10	Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more