CVE-2023-27269
Assigner: sap
Published: 2023-03-14T04:58:10.184Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: NetWeaver Application Server for ABAP and ABAP Platform
vendor: SAP
versions: status: affected
version: 700
status: affected
version: 701
status: affected
version: 702
status: affected
version: 731
status: affected
version: 740
status: affected
version: 750
status: affected
version: 751
status: affected
version: 752
status: affected
version: 753
status: affected
version: 754
status: affected
version: 755
status: affected
version: 756
status: affected
version: 757
status: affected
version: 791
descriptions: supportingMedia: base64: no
type: text/html
value: <p>SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files.  In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.</p>
value: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files.  In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
type: CWE
source: discovery: UNKNOWN
title: Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
x_generator: engine: Vulnogram 0.1.0-dev