SAP NetWeaver Application Server For Java vulnerabilities

9 CVEs affecting SAP NetWeaver Application Server For Java, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-31405, published 2023-07-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-0017, published 2023-01-10. Critical severity, CVSS 9.8. EPSS: 15.7% chance of exploitation in the next 30 days. An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access…
CVE-2021-27635, published 2021-06-09. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a specially crafted XML file in the…
CVE-2022-27669, published 2022-04-12. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be restricted. This may result in an…
CVE-2023-30744, published 2023-05-09. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use of an open naming and directory API to…
CVE-2021-27621, published 2021-06-09. Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days. Information Disclosure vulnerability in UserAdmin application in SAP NetWeaver Application Server for Java, versions - 7.11,7.20,7.30,7.31,7.40 and 7.50 allows attackers to access restricted…
CVE-2023-23857, published 2023-03-14. High severity, CVSS 8.6. EPSS: 0.5% chance of exploitation in the next 30 days. Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to…
CVE-2023-26460, published 2023-03-14. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that require user identity
CVE-2023-31405, published 2023-07-11. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted…
CVE-2023-27268, published 2023-03-14. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of…