SAP NetWeaver As Abap Business Server Pages vulnerabilities

10 CVEs affecting SAP NetWeaver As Abap Business Server Pages, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-29185, published 2023-04-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-6215, published 2020-04-14. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an attacker to redirect users to a malicious site due to…
CVE-2020-6324, published 2020-09-09. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. SAP Netweaver AS ABAP(BSP Test Application sbspext_table), version-700,701,720,730,731,740,750,751,752,753,754,755, allows an unauthenticated attacker to send polluted URL to the victim, when the…
CVE-2020-6213, published 2020-04-24. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to reflected Cross-Site Scripting (XSS) via…
CVE-2020-6205, published 2020-03-10. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; does not sufficiently encode user…
CVE-2020-6246, published 2020-06-10. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs,…
CVE-2020-6217, published 2020-04-14. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in…
CVE-2020-6229, published 2020-04-14. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not sufficiently encode user…
CVE-2023-29185, published 2023-04-11. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a…
CVE-2023-24521, published 2023-02-14. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the…
CVE-2023-24529, published 2023-02-14. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow malicious inputs from untrusted sources,…