All the vulnerabilites related to sap - business_application_software_integrated_solution
cve-2017-16691
Vulnerability from cvelistv5
Published
2017-12-12 14:00
Modified
2024-09-17 00:31
Severity ?
Summary
SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted.
References
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/x_refsource_CONFIRM
https://launchpad.support.sap.com/#/notes/2546220x_refsource_CONFIRM
http://www.securityfocus.com/bid/101822vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:35:19.944Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/2546220"
          },
          {
            "name": "101822",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/101822"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP Note Assistant",
          "vendor": "SAP",
          "versions": [
            {
              "status": "affected",
              "version": "SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52"
            }
          ]
        }
      ],
      "datePublic": "2017-12-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type \u0027SAR\u0027. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Digital signature verification along with note file extraction",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-25T10:57:01",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/2546220"
        },
        {
          "name": "101822",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/101822"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "DATE_PUBLIC": "2017-12-12T00:00:00",
          "ID": "CVE-2017-16691",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP Note Assistant",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type \u0027SAR\u0027. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Digital signature verification along with note file extraction"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/",
              "refsource": "CONFIRM",
              "url": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/2546220",
              "refsource": "CONFIRM",
              "url": "https://launchpad.support.sap.com/#/notes/2546220"
            },
            {
              "name": "101822",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/101822"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2017-16691",
    "datePublished": "2017-12-12T14:00:00Z",
    "dateReserved": "2017-11-09T00:00:00",
    "dateUpdated": "2024-09-17T00:31:20.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2017-16682
Vulnerability from cvelistv5
Published
2017-12-12 14:00
Modified
2024-09-16 22:39
Severity ?
Summary
SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator credentials to inject code that can be executed by the application and thereby control the behavior of the application.
References
http://www.securityfocus.com/bid/102143vdb-entry, x_refsource_BID
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/x_refsource_CONFIRM
https://launchpad.support.sap.com/#/notes/2526781x_refsource_CONFIRM
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:35:19.953Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "102143",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/102143"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/2526781"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP NetWeaver Internet Transaction Server (ITS)",
          "vendor": "SAP",
          "versions": [
            {
              "status": "affected",
              "version": "from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52"
            }
          ]
        }
      ],
      "datePublic": "2017-12-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator credentials to inject code that can be executed by the application and thereby control the behavior of the application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Code Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-13T10:57:01",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "name": "102143",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/102143"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/2526781"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "DATE_PUBLIC": "2017-12-12T00:00:00",
          "ID": "CVE-2017-16682",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP NetWeaver Internet Transaction Server (ITS)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator credentials to inject code that can be executed by the application and thereby control the behavior of the application."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Code Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "102143",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/102143"
            },
            {
              "name": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/",
              "refsource": "CONFIRM",
              "url": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/2526781",
              "refsource": "CONFIRM",
              "url": "https://launchpad.support.sap.com/#/notes/2526781"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2017-16682",
    "datePublished": "2017-12-12T14:00:00Z",
    "dateReserved": "2017-11-09T00:00:00",
    "dateUpdated": "2024-09-16T22:39:53.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2018-2363
Vulnerability from cvelistv5
Published
2018-01-09 15:00
Modified
2024-08-05 04:14
Severity ?
Summary
SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials.
References
https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/x_refsource_CONFIRM
https://launchpad.support.sap.com/#/notes/1906212x_refsource_CONFIRM
http://www.securityfocus.com/bid/102449vdb-entry, x_refsource_BID
https://launchpad.support.sap.com/#/notes/2525392x_refsource_CONFIRM
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:14:39.709Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/1906212"
          },
          {
            "name": "102449",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/102449"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/2525392"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP NetWeaver",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "7.00"
            },
            {
              "status": "affected",
              "version": "7.02"
            },
            {
              "status": "affected",
              "version": "7.10"
            },
            {
              "status": "affected",
              "version": "7.11"
            },
            {
              "status": "affected",
              "version": "7.30"
            },
            {
              "status": "affected",
              "version": "7.31"
            },
            {
              "status": "affected",
              "version": "7.40"
            },
            {
              "status": "affected",
              "version": "7.50"
            },
            {
              "status": "affected",
              "version": "7.52"
            }
          ]
        }
      ],
      "datePublic": "2018-01-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user\u0027s choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Code Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-11T10:57:01",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/1906212"
        },
        {
          "name": "102449",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/102449"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/2525392"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2018-2363",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP NetWeaver",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.00"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.02"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.10"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.11"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.30"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.31"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.40"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.50"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.52"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user\u0027s choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Code Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/",
              "refsource": "CONFIRM",
              "url": "https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/1906212",
              "refsource": "CONFIRM",
              "url": "https://launchpad.support.sap.com/#/notes/1906212"
            },
            {
              "name": "102449",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/102449"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/2525392",
              "refsource": "CONFIRM",
              "url": "https://launchpad.support.sap.com/#/notes/2525392"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2018-2363",
    "datePublished": "2018-01-09T15:00:00",
    "dateReserved": "2017-12-15T00:00:00",
    "dateUpdated": "2024-08-05T04:14:39.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2018-2367
Vulnerability from cvelistv5
Published
2018-03-01 17:00
Modified
2024-08-05 04:14
Severity ?
Summary
ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
References
https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/x_refsource_CONFIRM
http://www.securityfocus.com/bid/103006vdb-entry, x_refsource_BID
https://launchpad.support.sap.com/#/notes/2562089x_refsource_CONFIRM
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:14:39.579Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
          },
          {
            "name": "103006",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103006"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/2562089"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP BASIS (ABAP File Interface)",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "from 7.00 to 7.02"
            },
            {
              "status": "affected",
              "version": "from 7.10 to 7.11"
            },
            {
              "status": "affected",
              "version": "7.30"
            },
            {
              "status": "affected",
              "version": "7.31"
            },
            {
              "status": "affected",
              "version": "7.40"
            },
            {
              "status": "affected",
              "version": "from 7.50 to 7.52"
            }
          ]
        }
      ],
      "datePublic": "2018-02-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Directory Traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-02T10:57:01",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
        },
        {
          "name": "103006",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/103006"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/2562089"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2018-2367",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP BASIS (ABAP File Interface)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "from 7.00 to 7.02"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "from 7.10 to 7.11"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.30"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.31"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.40"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "from 7.50 to 7.52"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Directory Traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/",
              "refsource": "CONFIRM",
              "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
            },
            {
              "name": "103006",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/103006"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/2562089",
              "refsource": "CONFIRM",
              "url": "https://launchpad.support.sap.com/#/notes/2562089"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2018-2367",
    "datePublished": "2018-03-01T17:00:00",
    "dateReserved": "2017-12-15T00:00:00",
    "dateUpdated": "2024-08-05T04:14:39.579Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2019-0279
Vulnerability from cvelistv5
Published
2019-04-10 20:17
Modified
2024-08-04 17:44
Severity ?
Summary
ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges.
References
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114x_refsource_CONFIRM
https://launchpad.support.sap.com/#/notes/2753629x_refsource_CONFIRM
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:44:16.179Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/2753629"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP BASIS",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c from 7.00 to 7.02"
            },
            {
              "status": "affected",
              "version": "\u003c from 7.10 to 7.30"
            },
            {
              "status": "affected",
              "version": "\u003c 7.31"
            },
            {
              "status": "affected",
              "version": "\u003c 7.40"
            },
            {
              "status": "affected",
              "version": "\u003c from 7.50 to 7.53"
            }
          ]
        }
      ],
      "datePublic": "2019-04-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-10T20:17:27",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/2753629"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2019-0279",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP BASIS",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "from 7.00 to 7.02"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "from 7.10 to 7.30"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "7.31"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "7.40"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "from 7.50 to 7.53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114",
              "refsource": "CONFIRM",
              "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/2753629",
              "refsource": "CONFIRM",
              "url": "https://launchpad.support.sap.com/#/notes/2753629"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2019-0279",
    "datePublished": "2019-04-10T20:17:27",
    "dateReserved": "2018-11-26T00:00:00",
    "dateUpdated": "2024-08-04T17:44:16.179Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2018-2494
Vulnerability from cvelistv5
Published
2018-12-11 23:00
Modified
2024-08-05 04:21
Severity ?
Summary
Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform.
References
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2698996x_refsource_MISC
Impacted products
Vendor Product Version
SAP SAP Basis (ABAP Platform) Version: = 7.50 to 7.53
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:21:34.075Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/2698996"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP Basis (AS ABAP of SAP NetWeaver)",
          "vendor": "SAP",
          "versions": [
            {
              "status": "affected",
              "version": "= 7.00 to 7.02"
            },
            {
              "status": "affected",
              "version": "= 7.10 to 7.30"
            },
            {
              "status": "affected",
              "version": "= 7.31"
            },
            {
              "status": "affected",
              "version": "= 7.40"
            }
          ]
        },
        {
          "product": "SAP Basis (ABAP Platform)",
          "vendor": "SAP",
          "versions": [
            {
              "status": "affected",
              "version": "= 7.50 to 7.53"
            }
          ]
        }
      ],
      "datePublic": "2018-12-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Missing Authorization Check",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-11T22:57:01",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/2698996"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2018-2494",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP Basis (AS ABAP of SAP NetWeaver)",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "=",
                            "version_value": "7.00 to 7.02"
                          },
                          {
                            "version_name": "=",
                            "version_value": "7.10 to 7.30"
                          },
                          {
                            "version_name": "=",
                            "version_value": "7.31"
                          },
                          {
                            "version_name": "=",
                            "version_value": "7.40"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP Basis (ABAP Platform)",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "=",
                            "version_value": "7.50 to 7.53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Missing Authorization Check"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699",
              "refsource": "MISC",
              "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/2698996",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/2698996"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2018-2494",
    "datePublished": "2018-12-11T23:00:00",
    "dateReserved": "2017-12-15T00:00:00",
    "dateUpdated": "2024-08-05T04:21:34.075Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2018-12-11 22:29
Modified
2024-11-21 04:03
Severity ?
8.0 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Summary
Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform.
References
cna@sap.comhttps://launchpad.support.sap.com/#/notes/2698996Permissions Required, Vendor Advisory
cna@sap.comhttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/2698996Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699Vendor Advisory
Impacted products
Vendor Product Version
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution 7.31
sap business_application_software_integrated_solution 7.40


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF38D1E1-E07F-4E51-AE76-E27E7CE4F55C",
              "versionEndIncluding": "7.02",
              "versionStartIncluding": "7.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "03F8C580-971A-46D8-B66D-B1261F17FF22",
              "versionEndIncluding": "7.30",
              "versionStartIncluding": "7.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DC0CEF3-7409-418E-9C9A-E75D8B290D57",
              "versionEndIncluding": "7.53",
              "versionStartIncluding": "7.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "341C07C1-2B4A-475D-B200-1021EB6B1F79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D80CC30-EE05-439F-BF2C-1267837137DE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform."
    },
    {
      "lang": "es",
      "value": "Se han solucionado las comprobaciones de autorizaci\u00f3n necesarias para un usuario autenticado, que resultaban en un escalado de privilegios, en SAP Basis AS ABAP en SAP NetWeaver, del 700 al 750 y desde el 750, provistos como plataforma ABAP."
    }
  ],
  "id": "CVE-2018-2494",
  "lastModified": "2024-11-21T04:03:55.070",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-12-11T22:29:00.377",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2698996"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2698996"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2017-12-12 14:29
Modified
2024-11-21 03:16
Severity ?
6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Summary
SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted.
References
cna@sap.comhttp://www.securityfocus.com/bid/101822Third Party Advisory, VDB Entry
cna@sap.comhttps://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Issue Tracking, Vendor Advisory
cna@sap.comhttps://launchpad.support.sap.com/#/notes/2546220Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/101822Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/2546220Permissions Required, Vendor Advisory
Impacted products
Vendor Product Version
sap business_application_software_integrated_solution 7.00
sap business_application_software_integrated_solution 7.01
sap business_application_software_integrated_solution 7.02
sap business_application_software_integrated_solution 7.10
sap business_application_software_integrated_solution 7.11
sap business_application_software_integrated_solution 7.30
sap business_application_software_integrated_solution 7.31
sap business_application_software_integrated_solution 7.40
sap business_application_software_integrated_solution 7.50
sap business_application_software_integrated_solution 7.51
sap business_application_software_integrated_solution 7.52


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E134E2C-5C0D-40D7-AB0F-A38CAAC4D9A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.01:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9D7FB26-58C9-45A9-979D-62F42D75B294",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.02:*:*:*:*:*:*:*",
              "matchCriteriaId": "4DE21E08-659C-46FD-A727-AF0A0F2FCD00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2F8C457-3B41-4FAB-80BF-8C34C41B9590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEEF9CCF-90F4-4CE0-839C-B4FA32AAD434",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "990D5985-7828-4D8C-9463-CA077AB3881E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "341C07C1-2B4A-475D-B200-1021EB6B1F79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D80CC30-EE05-439F-BF2C-1267837137DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.50:*:*:*:*:*:*:*",
              "matchCriteriaId": "8774E4DD-6F98-4DAF-9BDF-FDA00D542798",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.51:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7B23697-D4DC-44B0-B430-F15F0F6BCB02",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.52:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EF9B1FD-826E-4DF2-ABED-4D9D093910AE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type \u0027SAR\u0027. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted."
    },
    {
      "lang": "es",
      "value": "\"La herramienta SAP Note Assistant \nSAP Note Assistant tool (SAP BASIS desde la versi\u00f3n 7.00 hasta la 7.02; desde la versi\u00f3n 7.10 hasta la 7.11, 7.30, 7.31 y 7.40 y desde la versi\u00f3n 7.50 hasta la 7.52) es compatible con la subida de archivos note firmados digitalmente de tipo \"\"SAR\"\". La verificaci\u00f3n de firma digital se realiza conjuntamente con la extracci\u00f3n del archivo note contenido en el archivo SAR. Es posible anexar un archivo falsificado al archivo SAR empleando la herramienta SAPCAR. Durante la extracci\u00f3n, la verificaci\u00f3n de firma digital fracasa, pero el archivo falsificado se extrae.\""
    }
  ],
  "id": "CVE-2017-16691",
  "lastModified": "2024-11-21T03:16:49.790",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.8,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-12-12T14:29:00.700",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/101822"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2546220"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/101822"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2546220"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2019-04-10 21:29
Modified
2024-11-21 04:16
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges.
References
cna@sap.comhttps://launchpad.support.sap.com/#/notes/2753629Permissions Required, Vendor Advisory
cna@sap.comhttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/2753629Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114Vendor Advisory
Impacted products
Vendor Product Version
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution 7.31
sap business_application_software_integrated_solution 7.40


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF38D1E1-E07F-4E51-AE76-E27E7CE4F55C",
              "versionEndIncluding": "7.02",
              "versionStartIncluding": "7.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "03F8C580-971A-46D8-B66D-B1261F17FF22",
              "versionEndIncluding": "7.30",
              "versionStartIncluding": "7.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DC0CEF3-7409-418E-9C9A-E75D8B290D57",
              "versionEndIncluding": "7.53",
              "versionStartIncluding": "7.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "341C07C1-2B4A-475D-B200-1021EB6B1F79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D80CC30-EE05-439F-BF2C-1267837137DE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges."
    },
    {
      "lang": "es",
      "value": "Los m\u00f3dulos de funci\u00f3n ABAP BASIS INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, e INST_CREATE_TCPIP_RFC_DEST en SAP BASIS (corregidos en las versiones 7.0 hasta 7.02, 7.10 hasta 7.30, 7.31, 7.50, 7.50 hasta 7.53) no realiza la comprobaci\u00f3n de autorizaci\u00f3n necesaria en todas la circunstancias para un usuario autenticado, resultando en una escalada de privilegios."
    }
  ],
  "id": "CVE-2019-0279",
  "lastModified": "2024-11-21T04:16:37.650",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-04-10T21:29:01.153",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2753629"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2753629"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2018-01-09 15:29
Modified
2024-11-21 04:03
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials.
References
cna@sap.comhttp://www.securityfocus.com/bid/102449Third Party Advisory, VDB Entry
cna@sap.comhttps://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/Vendor Advisory
cna@sap.comhttps://launchpad.support.sap.com/#/notes/1906212Permissions Required
cna@sap.comhttps://launchpad.support.sap.com/#/notes/2525392Permissions Required
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/102449Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/1906212Permissions Required
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/2525392Permissions Required
Impacted products
Vendor Product Version
sap netweaver -
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution 7.30
sap business_application_software_integrated_solution 7.31
sap business_application_software_integrated_solution 7.40


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB7AAA9B-5209-4419-87DA-8130843AD2AF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF38D1E1-E07F-4E51-AE76-E27E7CE4F55C",
              "versionEndIncluding": "7.02",
              "versionStartIncluding": "7.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CB61EF9-414F-4563-B091-3E9B708CAB1E",
              "versionEndIncluding": "7.11",
              "versionStartIncluding": "7.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D90BE6E0-559E-4509-95EA-CB820611E16D",
              "versionEndIncluding": "7.52",
              "versionStartIncluding": "7.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "990D5985-7828-4D8C-9463-CA077AB3881E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "341C07C1-2B4A-475D-B200-1021EB6B1F79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D80CC30-EE05-439F-BF2C-1267837137DE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user\u0027s choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials."
    },
    {
      "lang": "es",
      "value": "SAP NetWeaver y SAP BASIS, desde la versi\u00f3n 7.00 hasta la 7.02, desde la 7.10 a la 7.11, 7.30, 7.31, 7.40 y desde la versi\u00f3n 7.50 a la 7.52, contiene c\u00f3digo que permite ejecutar c\u00f3digo arbitrario del programa a elecci\u00f3n del usuario. Un usuario malicioso puede, por lo tanto, controlar el comportamiento del sistema o escalar privilegios mediante la ejecuci\u00f3n de c\u00f3digo malicioso sin credenciales leg\u00edtimas."
    }
  ],
  "id": "CVE-2018-2363",
  "lastModified": "2024-11-21T04:03:40.973",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-01-09T15:29:00.370",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/102449"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/1906212"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2525392"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/102449"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://blogs.sap.com/2018/01/09/sap-security-patch-day-january-2018/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/1906212"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2525392"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2018-03-01 17:29
Modified
2024-11-21 04:03
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
References
cna@sap.comhttp://www.securityfocus.com/bid/103006Third Party Advisory, VDB Entry
cna@sap.comhttps://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/Vendor Advisory
cna@sap.comhttps://launchpad.support.sap.com/#/notes/2562089Permissions Required
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/103006Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/2562089Permissions Required
Impacted products
Vendor Product Version
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution 7.30
sap business_application_software_integrated_solution 7.31
sap business_application_software_integrated_solution 7.40


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF38D1E1-E07F-4E51-AE76-E27E7CE4F55C",
              "versionEndIncluding": "7.02",
              "versionStartIncluding": "7.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CB61EF9-414F-4563-B091-3E9B708CAB1E",
              "versionEndIncluding": "7.11",
              "versionStartIncluding": "7.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D90BE6E0-559E-4509-95EA-CB820611E16D",
              "versionEndIncluding": "7.52",
              "versionStartIncluding": "7.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "990D5985-7828-4D8C-9463-CA077AB3881E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "341C07C1-2B4A-475D-B200-1021EB6B1F79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D80CC30-EE05-439F-BF2C-1267837137DE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs."
    },
    {
      "lang": "es",
      "value": "ABAP File Interface en SAP BASIS, de la versi\u00f3n 7.00 a la 7.02, de la versi\u00f3n 7.10 a la 7.11, 7.30, 7.31, 7.40 y de la versi\u00f3n 7.50 a la 7.52, permite que un atacante explote la validaci\u00f3n insuficiente de la informaci\u00f3n de ruta proporcionada por los usuarios, por lo que los caracteres que representan \"salto al directorio padre\" se pasan a las API de archivo."
    }
  ],
  "id": "CVE-2018-2367",
  "lastModified": "2024-11-21T04:03:41.423",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-03-01T17:29:00.287",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/103006"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2562089"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/103006"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2562089"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2017-12-12 14:29
Modified
2024-11-21 03:16
Severity ?
7.2 (High) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator credentials to inject code that can be executed by the application and thereby control the behavior of the application.
References
cna@sap.comhttp://www.securityfocus.com/bid/102143Third Party Advisory, VDB Entry
cna@sap.comhttps://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Vendor Advisory
cna@sap.comhttps://launchpad.support.sap.com/#/notes/2526781Permissions Required
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/102143Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/2526781Permissions Required
Impacted products
Vendor Product Version
sap netweaver_internet_transaction_server -
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution *
sap business_application_software_integrated_solution 7.30
sap business_application_software_integrated_solution 7.31
sap business_application_software_integrated_solution 7.40


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver_internet_transaction_server:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EBD79C3-7B56-4065-B2B3-8FC54EB46CF0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF38D1E1-E07F-4E51-AE76-E27E7CE4F55C",
              "versionEndIncluding": "7.02",
              "versionStartIncluding": "7.00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D90BE6E0-559E-4509-95EA-CB820611E16D",
              "versionEndIncluding": "7.52",
              "versionStartIncluding": "7.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "990D5985-7828-4D8C-9463-CA077AB3881E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "341C07C1-2B4A-475D-B200-1021EB6B1F79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:business_application_software_integrated_solution:7.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D80CC30-EE05-439F-BF2C-1267837137DE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator credentials to inject code that can be executed by the application and thereby control the behavior of the application."
    },
    {
      "lang": "es",
      "value": "SAP NetWeaver Internet Transaction Server (ITS), SAP Basis desde la versi\u00f3n 7.00 hasta la 7.02, 7.30, 7.31 y 7.40 y desde la versi\u00f3n 7.50 hasta la 7.52, permite que un atacante con credenciales de administrador inyecte c\u00f3digo que puede ser ejecutado por la aplicaci\u00f3n y as\u00ed controlar el comportamiento de la aplicaci\u00f3n."
    }
  ],
  "id": "CVE-2017-16682",
  "lastModified": "2024-11-21T03:16:49.000",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-12-12T14:29:00.403",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/102143"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2526781"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/102143"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2526781"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}