Path Traversal in SAP Netweaver Application Server Abap
CVE-2023-27269
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files. In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.010 (59.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H.
Affected products
- Sap Netweaver_application_server_abap — versions 700, 701, 702
- Sap Netweaver Application Server For Abap And Platform — versions 700, 701, 702
Weakness classification (CWE)
References
- cna@sap.com (Permissions Required)
- cna@sap.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-27269?
- CVE-2023-27269 is a critical-severity vulnerability in SAP Netweaver Application Server Abap, classified under Path Traversal. CVSS score: 9.6/10. Published 2023-03-14.
- How severe is CVE-2023-27269?
- Critical severity. CVSS v3 base score is 9.6 out of 10.