CVE-2023-27501highCWE-22

CVE-2023-27501: high-severity vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Published · Updated

Follow this CVE+ Monitor ABAP Platform+ Monitor SAP NetWeaver AS for ABAP

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 1.0%
SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw in an available service to delete system files. In this attack, no data can be read but potentially critical OS files can be deleted making the system unavailable, causing significant impact on both availability and integrity
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Affected products
SAP · NetWeaver AS for ABAP and ABAP Platform
Related CVEs — SAP NetWeaver AS for ABAP and ABAP Platform

In the same product, most dangerous first.

CVE-2023-28763MEDIUMDenial of Service in SAP NetWeaver AS for ABAP and ABAP PlatformEPSS 0.6%CVE-2023-25618MEDIUMDenial of Service (DoS) vulnerability in SAP NetWeaver AS for ABAP and ABAP PlatformEPSS 0.6%CVE-2023-23859MEDIUMCVE-2023-23859EPSS 0.4%CVE-2023-26459HIGHServer Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS for ABAP and ABAP PlatformEPSS 0.4%CVE-2023-0013MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP PlatformEPSS 0.4%CVE-2023-23860MEDIUMCVE-2023-23860EPSS 0.4%