CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2021-21492
https://notcve.org/view.php?id=CVE-2021-21492
SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a content spoofing vulnerability when directory listing is enabled. SAP NetWeaver Application Server Java (HTTP Service), versiones - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, no comprueba suficientemente el grupo de inicio de sesión en las URL, resultando en una vulnerabilidad de suplantación de contenido cuando la lista de directorios está habilitada • https://launchpad.support.sap.com/#/notes/3025637 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-27598
https://notcve.org/view.php?id=CVE-2021-27598
SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet. SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versiones - 7.31, 7.40, 7.50, permite a un atacante leer algunos datos estadísticos como la versión del producto, el tráfico, la marca de tiempo, etc. debido a una falta de comprobación de autorización en el servlet • https://launchpad.support.sap.com/#/notes/3027937 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 • CWE-284: Improper Access Control CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2021-21491
https://notcve.org/view.php?id=CVE-2021-21491
SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. SAP Netweaver Application Server Java (Aplicaciones basadas en WebDynpro Java) versiones 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, permiten a un atacante redireccionar a usuarios a un sitio malicioso debido a vulnerabilidades de Reverse Tabnabbing • https://launchpad.support.sap.com/#/notes/2976947 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26826
https://notcve.org/view.php?id=CVE-2020-26826
Process Integration Monitoring of SAP NetWeaver AS JAVA, versions - 7.31, 7.40, 7.50, allows an attacker to upload any file (including script files) without proper file format validation, leading to Unrestricted File Upload. Process Integration Monitoring de SAP NetWeaver AS JAVA, versiones 7.31, 7.40, 7.50, permite a un atacante cargar cualquier archivo (incluyendo los archivos de script) sin la comprobación apropiada del formato de archivo, conllevando a una Carga de Archivos Sin Restricciones • https://launchpad.support.sap.com/#/notes/2974330 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2020-26829 – SAP Netweaver JAVA 7.50 Missing Authorization
https://notcve.org/view.php?id=CVE-2020-26829
SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missing authentication check, that are outside the cluster and even outside the network segment dedicated for the internal cluster communication. As result, an unauthenticated attacker can invoke certain functions that would otherwise be restricted to system administrators only, including access to system administration functions or shutting down the system completely. SAP NetWeaver AS JAVA (P2P Cluster Communication), versiones - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, permite conexiones arbitrarias de procesos debido a una falta de comprobación de autenticación, que están fuera del clúster e incluso fuera del segmento de red dedicado para la comunicación interna del clúster. Como resultado, un atacante no autenticado puede invocar determinadas funciones que de otro modo estarían restringidas sólo a los administradores del sistema, incluyendo el acceso a las funciones de administración del sistema o apagando el sistema por completo A malicious unauthenticated user could abuse the lack of authentication check on SAP Java P2P cluster communication in order to connect to the respective TCP ports and perform different privileged actions. SAP Netweaver JAVA versions 7.10 through 7.50 are affected. • http://packetstormsecurity.com/files/163166/SAP-Netweaver-JAVA-7.50-Missing-Authorization.html http://seclists.org/fulldisclosure/2021/Jun/33 https://launchpad.support.sap.com/#/notes/2974774 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 • CWE-306: Missing Authentication for Critical Function •