CVE-2010-5326criticalunder attackCWE-306

CVE-2010-5326

Published · Updated

Follow this CVE+ Monitor SAP NetWeaver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and 1 threat group(s) use it.

ssvc Actcvss 10epss 18%
from disclosure to weapon
Published on NVDMay 13
CISA KEV+2000d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateFIN13 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

SAP NetWeaver's Invoker Servlet allows anyone on the internet to execute code without logging in, making it possible for attackers to take complete control of the server.

Technical detail

The Invoker Servlet in SAP NetWeaver Application Server Java (versions before 7.3) lacks authentication controls (CWE-306), enabling unauthenticated remote code execution via HTTP/HTTPS requests. This vulnerability was actively exploited in the wild from 2013-2016 and permits arbitrary code execution with full system privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
n/a · n/a