Path Traversal in SAP Netweaver Application Server Abap
CVE-2023-27501
SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw in an available service to delete system files. In this attack, no data can be read but potentially critical OS files can be deleted making the system unavailable, causing significant impact on both availability and integrity
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.010 (59.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H.
Affected products
- Sap Netweaver_application_server_abap — versions 700, 701, 702
- Sap Netweaver As For Abap And Platform — versions 700, 701, 702
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@sap.com (Permissions Required)
- cna@sap.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-27501?
- CVE-2023-27501 is a high-severity vulnerability in SAP Netweaver Application Server Abap, classified under Path Traversal. CVSS score: 8.7/10. Published 2023-03-14.
- How severe is CVE-2023-27501?
- High severity. CVSS v3 base score is 8.7 out of 10.
- Is CVE-2023-27501 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.