Riskcovery

CVE-2023-27269

Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

State
Published
Severity
9.6 Critical
Published
Mar 14, 2023
Updated
Feb 27, 2025
Reserved
Feb 27, 2023

Read the record on cve.org

Description

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files.  In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.

Scores

CVSSScoreVectorSource
3.19.6 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:Hsap

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
NetWeaver Application Server for ABAP and ABAP PlatformSAP
  • 700Affected
  • 701Affected
  • 702Affected
  • 731Affected
  • 740Affected
  • 750Affected
  • 751Affected
  • 752Affected
  • 753Affected
  • 754Affected
  • 755Affected
  • 756Affected
  • 757Affected
  • 791Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.