SAP NetWeaver Development Infrastructure vulnerabilities

4 CVEs affecting SAP NetWeaver Development Infrastructure, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-29618, published 2022-06-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-33690, published 2021-09-15. Critical severity, CVSS 9.9. EPSS: 69.1% chance of exploitation in the next 30 days. Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP…
CVE-2013-6820, published 2013-11-20. High severity, CVSS 9.3. EPSS: 3.6% chance of exploitation in the next 30 days. Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure (NWDI) allows remote attackers to execute arbitrary code by uploading a file with an executable extension via…
CVE-2022-29618, published 2022-06-14. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. Due to insufficient input validation, SAP NetWeaver Development Infrastructure (Design Time Repository) - versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to inject script into the…
CVE-2021-33691, published 2021-09-15. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.SAP NetWeaver Development…