// For flags

CVE-2023-27501

Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Severity Score

9.6
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw in an available service to delete system files. In this attack, no data can be read but potentially critical OS files can be deleted making the system unavailable, causing significant impact on both availability and integrity

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-03-02 CVE Reserved
  • 2023-03-14 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-10-04 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
700
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "700"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
701
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "701"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
702
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "702"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
731
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "731"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
740
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "740"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
750
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "750"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
751
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "751"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
752
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "752"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
753
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "753"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
754
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "754"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
755
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "755"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
756
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "756"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
757
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "757"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Abap
Search vendor "Sap" for product "Netweaver Application Server Abap"
791
Search vendor "Sap" for product "Netweaver Application Server Abap" and version "791"
-
Affected