SAP NetWeaver Abap vulnerabilities

21 CVEs affecting SAP NetWeaver Abap, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-33005, published 2024-08-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-4341, published 2012-08-15. High severity, CVSS 10.0. EPSS: 8.5% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) long parameter…
CVE-2017-9843, published 2017-07-12. Low severity, CVSS 2.7. EPSS: 2.3% chance of exploitation in the next 30 days. SAP NetWeaver AS ABAP 7.40 allows remote authenticated users with certain privileges to cause a denial of service (process crash) via vectors involving disp+work.exe, aka SAP Security Note 2406841.
CVE-2015-1309, published 2015-01-22. Medium severity, CVSS 5.0. EPSS: 2.2% chance of exploitation in the next 30 days. XML external entity vulnerability in the Extended Computer Aided Test Tool (eCATT) in SAP NetWeaver AS ABAP 7.31 and earlier allows remote attackers to access arbitrary files via a crafted XML…
CVE-2014-8312, published 2014-10-16. Low severity, CVSS 3.5. EPSS: 2.1% chance of exploitation in the next 30 days. Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information via a request to the RSDU_CCMS_GET_PROFILE_PARAM RFC function.
CVE-2021-27633, published 2021-06-09. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL -…
CVE-2021-27597, published 2021-06-09. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL -…
CVE-2022-22543, published 2022-02-09. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53,…
CVE-2021-27634, published 2021-06-09. Medium severity, CVSS 5.9. EPSS: 1.3% chance of exploitation in the next 30 days. SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL -…
CVE-2021-27610, published 2021-06-16. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal and external RFC user in consistent and…
CVE-2021-38178, published 2021-10-12. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP…

Latest

CVE-2024-33005, published 2024-08-13. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP Content Server can impersonate other…
CVE-2022-29614, published 2022-06-14. Medium severity, CVSS 5.0. EPSS: 0.4% chance of exploitation in the next 30 days. SAP startservice - of SAP NetWeaver Application Server ABAP, Application Server Java, ABAP Platform and HANA Database - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC…
CVE-2022-29612, published 2022-06-14. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. SAP NetWeaver, ABAP Platform and SAP Host Agent - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, 8.04, KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, 8.04,…
CVE-2022-28215, published 2022-04-12. Medium severity, CVSS 4.7. EPSS: 0.8% chance of exploitation in the next 30 days. SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to…
CVE-2022-22545, published 2022-02-09. Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days. A high privileged user who has access to transaction SM59 can read connection details stored with the destination for http calls in SAP NetWeaver Application Server ABAP and ABAP Platform - versions…
CVE-2021-42067, published 2022-01-14. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana…
CVE-2021-40496, published 2021-10-12. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication…
CVE-2021-40495, published 2021-10-12. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755. An unauthorized attacker can use the…
CVE-2021-38181, published 2021-10-12. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate users from accessing a service, either by…