Riskcovery

CVE-2023-27501

Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

State
Published
Severity
8.7 High
Published
Mar 14, 2023
Updated
Feb 27, 2025
Reserved
Mar 2, 2023

Read the record on cve.org

Description

SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw in an available service to delete system files. In this attack, no data can be read but potentially critical OS files can be deleted making the system unavailable, causing significant impact on both availability and integrity

Scores

CVSSScoreVectorSource
3.18.7 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:Hsap

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
NetWeaver AS for ABAP and ABAP PlatformSAP
  • 700Affected
  • 701Affected
  • 702Affected
  • 731Affected
  • 740Affected
  • 750Affected
  • 751Affected
  • 752Affected
  • 753Affected
  • 754Affected
  • 755Affected
  • 756Affected
  • 757Affected
  • 791Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.