CVE-2022-22536

CVE-2022-22536 affects SAP NetWeaver components (ABAP/Java stacks), ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher. The issue is HTTP request smuggling/concatenation caused by how the SAP ICM front end parses requests, enabling an unauthenticated attacker to prepend arbitrary data...

CVE-2021-33684

CVE-2021-33684 affects SAP NetWeaver AS ABAP and ABAP Platform (multiple KRNL32NUC/KRNL32UC/KRNL64NUC/KRNL64UC/KERNEL versions). The issue is a memory corruption vulnerability caused by processing overly long content in RFC requests, which can crash the affected work process. The process then res...

CVE-2019-0321

CVE-2019-0321 affects SAP ABAP Platform / SAP Basis (versions 7.31, 7.4, 7.5). The vulnerability arises from insufficient encoding of user-controlled inputs, leading to a Cross‑Site Scripting (XSS) issue. The connected PT-2019-4588 entry corroborates the issue and describes the affected versions ...

CVE-2023-0014

CVE-2023-0014 affects SAP NetWeaver ABAP Server and ABAP Platform on multiple SAP_BASIS versions (700…757) and kernel/CR components (e.g., 7.22, 7.53, 7.77, 7.81, 7.85, 7.89; KRNL64UC/NUC) where the system identity is created in an ambiguous format. This behavior can enable a capture-replay vulne...

CVE-2022-22540

CVE-2022-22540 affects SAP NetWeaver AS ABAP (Workplace Server) across multiple versions (700, 701, 702, 731, 740, 750–756, 787). The connected sources describe a SQL injection vulnerability that enables an attacker to execute crafted database queries and potentially disclose a table of contents ...

CVE-2023-27269

SAP NetWeaver AS ABAP/ABAP Platform (versions 700–757, 791) is affected by CVE-2023-27269, a directory-traversal flaw in an available service that lets an attacker with non-administrative authorizations overwrite operating system files, potentially rendering the system unavailable. The flaw is de...

CVE-2022-26102

CVE-2022-26102 affects SAP NetWeaver Application Server for ABAP in versions 700, 701, 702, and 731, due to a missing authorization check that allows an authenticated attacker to access content on the start screen of any transaction within the same SAP system, even when not authorized for that tr...

CVE-2023-40309

CVE-2023-40309 affects SAP CommonCryptoLib and is caused by insufficient authentication checks, enabling possible privilege escalation for an authenticated user and potential reading/modification/deletion of restricted data. The vulnerability is rated CRITICAL (CVSSv3.1: 9.8, AV:N/AC:L/PR:N/UI:N/...

CVE-2022-29611

CVE-2022-29611 refers to SAP NetWeaver AS ABAP/ABAP Platform missing authorization checks for an authenticated user, enabling privilege escalation. The issue is described in multiple sources as a missing authorization vulnerability within SAP NetWeaver Application Server ABAP/ABAP Platform. The p...

CVE-2022-29610

Summary: CVE-2022-29610 affects SAP NetWeaver Application Server ABAP. An authenticated attacker can upload malicious files and delete data, enabling a Stored Cross-Site Scripting (XSS) attack due to inadequate input validation. Multiple connected sources corroborate this CVE and describe the sam...

CVE-2021-27610

CVE-2021-27610 affects SAP NetWeaver ABAP Server and ABAP Platform (versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804). The root cause is improper authentication due to failure to present internal and external RFC user information in a consistent, distinguished format, potential...

CVE-2022-41212

CVE-2022-41212 affects SAP NetWeaver Application Server ABAP and ABAP Platform. The root cause is insufficient input validation that enables an attacker with high privileges to invoke a remotely enabled function to read a file that is normally restricted, compromising confidentiality. The descrip...

CVE-2023-40308

The CVE-2023-40308 issue affects SAP CommonCryptoLib and is caused by memory corruption triggered by an unauthenticated crafted request sent to an open port. The resulting crash makes the target component unavailable, with no impact on confidentiality or integrity reported. Evidence across multip...

CVE-2023-27500

CVE-2023-27500 affects SAP NetWeaver AS ABAP/ABAP Platform and specifically the component exposed to a directory traversal flaw in the SAPRSBRO service, enabling an attacker with non-administrative authorizations to overwrite potentially critical OS files and render the system unavailable. The ro...

CVE-2021-33678

CVE-2021-33678 affects SAP NetWeaver AS ABAP (Reconciliation Framework) across multiple releases (700–75F). A high-privilege attacker can inject code executed by the application, potentially deleting data and causing DoS/unavailability. Affected component: Reconciliation Framework function module...

CVE-2024-24740

CVE-2024-24740 affects SAP NetWeaver Application Server (ABAP) — specifically kernel versions 7.53–7.94 and KRNL64UC 7.53. The issue is an information-disclosure vulnerability caused by insufficient protection of internal data, allowing an attacker to access information that could be restricted. ...

CVE-2022-41214

CVE-2022-41214 affects SAP NetWeaver Application Server ABAP and ABAP Platform. The root cause, as described across multiple sources, is insufficient input validation that enables a user with high privileges to invoke a remote-enabled function to delete a file that would normally be restricted. S...

CVE-2023-40624

SAP NetWeaver AS ABAP (Unified Rendering) is affected in SAP_UI 754–758 and SAP_BASIS 702, 731. The root cause is insufficient validation/escaping of user-supplied data, allowing an attacker to inject JavaScript that is executed in the web application. This can enable an attacker to influence the...

CVE-2021-33677

The CVE-2021-33677 entry affects SAP NetWeaver ABAP Server and ABAP Platform, specifically versions 700, 702, 730, 731, 804, 740, 750, and 784. The issue stems from exposing internal functions externally, which can lead to information disclosure. The connected documents confirm the affected softw...

CVE-2023-25618

CVE-2023-25618 affects SAP NetWeaver Application Server for ABAP/ABAP Platform (versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791). A DoS condition arises from multiple vulnerabilities in an unused error-handling class: an attacker authenticated as a non-administrative...

CVE-2021-38178

CVE-2021-38178 affects SAP NetWeaver AS ABAP and ABAP Platform versions 700–756. The vulnerability allows a malicious user to transfer ABAP code artifacts or content by bypassing the established quality gates, enabling code to reach quality and production and potentially compromising confidential...

CVE-2022-39799

CVE-2022-39799 affects SAP GUI for HTML within Fiori Launchpad. It enables an unauthenticated attacker to craft and deliver a reflected cross-site scripting (XSS) attack that can steal session information and impersonate the user. The CVE is referenced across multiple feeds (NVD, Red Hat, CVE Lis...

CVE-2020-6371

CVE-2020-6371 describes a user-enumeration vulnerability in SAP NetWeaver Application Server ABAP (POWL test application) affecting versions 710–750, leading to information disclosure of user accounts and personal data. The vulnerability is identified across multiple NOS and security adapters; th...

CVE-2021-42067

CVE-2021-42067 affects SAP NetWeaver AS for ABAP and ABAP Platform (versions 701, 702, 711, 730–756, 786). An authenticated regular user can use the S/4 Hana dashboard to reveal systems and services they normally should not see; no data modification or service denial is indicated. The publicly av...

CVE-2022-41215

CVE-2022-41215 affects SAP NetWeaver ABAP Server and ABAP Platform. The issue is an unauthenticated URL redirection caused by insufficient URL validation, potentially tricking users into disclosing personal information. The vulnerability is categorized with CVSSv3.1 base score 4.7 (Medium) and in...

CVE-2023-23860

CVE-2023-23860—SAP NetWeaver ABAP/ABAP Platform : Affects versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790. The issue allows an unauthenticated attacker to craft a link which, when clicked by a user, can redirect to a malicious site and potentially read/modify sensitive information ...

CVE-2024-41732

SAP NetWeaver Application Server ABAP is affected by CVE-2024-41732: an unauthenticated attacker can craft a URL that bypasses allowlists, potentially injecting CSS or links to read/modify information. Impact is limited to data confidentiality/ integrity; no availability impact is stated. Affecte...

CVE-2023-0013

The CVE-2023-0013 issue affects SAP NetWeaver Application Server for ABAP/ABAP Platform (ABAP Keyword Documentation) and its ABAP Platform components. The vulnerability arises because the ABAP keyword documentation does not sufficiently encode user-controlled inputs, enabling Cross-Site Scripting...

CVE-2023-26459

CVE-2023-26459 affects SAP NetWeaver AS for ABAP and ABAP Platform (versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791). The issue arises from improper input controls allowing an authenticated, non-administrative user to craft a request that makes the application server...

CVE-2020-6240

This CVE concerns SAP NetWeaver AS ABAP (Web Dynpro ABAP). The vulnerability allows an unauthenticated attacker to deny service to legitimate users by crashing or flooding the affected system. Affected components/versions identified across sources include SAP_UI 750, 752, 753, 754 and SAP_BASIS 7...

CVE-2021-21490

SAP NetWeaver AS for ABAP (Web Survey) is affected by CVE-2021-21490 due to insufficient encoding of input/output parameters in WebSurvey BSP-Pages, causing a reflected Cross-Site Scripting (XSS) vulnerability. Affected versions include Web Survey on SAP NetWeaver AS for ABAP 700, 702, 710, 711, ...

CVE-2021-21473

CVE-2021-21473 affects SAP NetWeaver AS ABAP and ABAP Platform versions 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755. The issue is in function module SRM_RFC_SUBMIT_REPORT which fails to validate authorization of an authenticated user, allowing an unauthorized user to execute r...

CVE-2023-27501

CVE-2023-27501 affects SAP NetWeaver AS for ABAP and ABAP Platform (versions 700–791). The issue is a directory traversal vulnerability caused by insufficient validation of user-supplied path information, enabling an attacker to use an available service to delete system files. Impact stated inclu...

CVE-2023-49581

CVE-2023-49581 affects SAP GUI for Windows and SAP GUI for Java. An unauthenticated attacker can access information that should be restricted and can also write data to a database table, potentially increasing response times of the AS ABAP and causing mild availability impact. Public details acro...

CVE-2021-38181

CVE-2021-38181 affects SAP NetWeaver AS ABAP and ABAP Platform versions 700–756. The issue enables a remote attacker to deny service to legitimate users by crashing or flooding the server (DoS). Root cause is a vulnerability in the ABAP/NetWeaver components; exploited over network with no authent...

CVE-2019-0257

The CVE affects SAP NetWeaver AS ABAP Platform. The issue is in the customization functionality that does not perform necessary authorization checks for an authenticated user, enabling escalation of privileges. Affected versions include: 7.0–7.02; 7.10–7.11; 7.30; 7.31; 7.40; 7.50–7.53; and 7.74–...

CVE-2021-21446

CVE-2021-21446 affects SAP NetWeaver AS ABAP (versions 740–755). An unauthenticated attacker can crash or flood the service, causing high availability impact. Connected sources corroborate the effect but do not provide publicly available remediation details in the supplied documents; at least one...

CVE-2020-6270

CVE-2020-6270 affects SAP NetWeaver AS ABAP (Banking Services) across versions 710, 711, 740, 750, 751, 752, 75A–75E. Root cause is a missing authorization check for an authenticated user, enabling unauthorized changes to individual conditions and potentially leading to incorrect pricing. Exploit...

CVE-2021-40496

CVE-2021-40496 affects SAP Internet Communication Framework (ICM). Affected versions include SAP ICM 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785. The issue allows an attacker with logon functionality to abuse the authentication function by submitting POST data through for...

CVE-2023-24522

CVE-2023-24522 affects SAP NetWeaver AS ABAP (Business Server Pages) and versions 700, 701, 702, 731, 740. Root cause: insufficient input sanitization that allows an unauthenticated user to inject malicious code over the network to alter a user’s current session, potentially exposing data. Impact...

CVE-2023-23853

CVE-2023-23853 affects SAP NetWeaver Application Server for ABAP and ABAP Platform (versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790). The vulnerability allows an unauthenticated attacker to craft a link that, when clicked by a user, redirects to a malicious site that...

CVE-2021-44235

CVE-2021-44235 affects SAP NetWeaver AS ABAP (versions 700–756). The vulnerability arises from two methods of a utility class that, when invoked by a user with high privileges and direct access to the SAP system, allow code injection via the transaction class builder. This could enable execution ...

CVE-2023-25614

CVE-2023-25614 affects SAP NetWeaver AS ABAP (BSP Framework) versions 700–757. An unauthenticated attacker can inject code executed by the application over the network, leading to limited impact on confidentiality and integrity. Connected sources (Red Hat, Nessus/NASL, and others) confirm the sam...

CVE-2023-27270

SAP NetWeaver Application Server for ABAP and ABAP Platform (versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791) is affected by a Denial of Service vulnerability where an attacker authenticated as a non-administrative user can craft a request with specific parameters to...

CVE-2023-37492

CVE-2023-37492 affects SAP NetWeaver Application Server ABAP and ABAP Platform. Affected versions are SAP_BASIS 700, 701, 702, 731, 740, 750, 752, 753, 754, 755, 756, 757, 758, 793, 804. The issue is described as missing authorization checks for an authenticated user, leading to privilege escalat...

CVE-2021-40495

CVE-2021-40495 : Multiple Denial-of-Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform (versions 740–755). An unauthenticated attacker can exploit the public SICF endpoint /sap/public/bc/abap to degrade performance of SAP NetWeaver AS ABAP/ABAP Platform. The Do...

CVE-2024-33001

CVE-2024-33001 concerns a Denial of Service in SAP NetWeaver and ABAP platform. The vulnerability allows an attacker to impede performance for legitimate users by crashing or flooding the SAP NetWeaver ABAP Server, leading to long response delays and potential service interruptions. The public de...

CVE-2020-26832

The CVE-2020-26832 issue affects SAP AS ABAP (SAP Landscape Transformation) and SAP S4 HANA (Landscape Transformation) with vulnerable versions: ABAP 2011_1_620/640/700/710/730/731/752 and S4 HANA 101–105. Root cause: missing authorization allows a high-privilege user to execute an RFC function m...

CVE-2021-27603

The CVE-2021-27603 entry concerns SAP NetWeaver AS ABAP. It affects SAP NetWeaver AS ABAP versions 731, 740, and 750, where the RFC function module SPI_WAIT_MILLIS can be invoked to keep a work process busy, enabling an attacker to repeatedly call it and block all work processes, causing a Denial...

CVE-2023-41366

CVE-2023-41366 affects SAP NetWeaver Application Server ABAP and ABAP Platform. Affected components/versions: KERNEL 722, KERNEL 7.53, 7.77, 7.85, 7.89, 7.54, 7.91, 7.92, 7.93, 7.94 and KERNEL64UC 7.22/7.22EXT, KERNEL64NUC 7.22/7.22EXT, KERNEL64UC 7.53. The issue arises from a lack of restriction...