SAP NetWeaver Enterprise Portal vulnerabilities

20 CVEs affecting SAP NetWeaver Enterprise Portal, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-47594, published 2024-10-08.

More from SAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-2812, published 2015-04-01. Medium severity, CVSS 5.0. EPSS: 2.5% chance of exploitation in the next 30 days. XML external entity (XXE) vulnerability in XMLValidationComponent in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP…
• CVE-2015-2811, published 2015-04-01. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. XML external entity (XXE) vulnerability in ReportXmlViewer in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security…
• CVE-2021-33703, published 2021-08-10. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a malicious link and send it to a victim.…
• CVE-2021-33702, published 2021-08-10. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attacker can craft malicious data and print it…
• CVE-2018-2435, published 2018-07-10. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal from 7.0 to 7.02, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
• CVE-2022-26105, published 2022-04-12. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user…
• CVE-2022-32247, published 2022-07-12. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the User…
• CVE-2022-24397, published 2022-03-10. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.This reflected…
• CVE-2022-35227, published 2022-07-12. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in SAP NW EP (WPC) - versions 7.30, 7.31, 7.40, 7.50, which does not sufficiently validate user-controlled input, allows a remote attacker to conduct a Cross-Site (XSS) scripting…
• CVE-2020-6323, published 2020-10-15. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal (Fiori Framework Page) versions - 7.50, 7.31, 7.40, does not sufficiently encode user-controlled inputs and allows an attacker on a valid session to create an XSS that…

Latest

• CVE-2024-47594, published 2024-10-08. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet. An attacker could craft a script and trick…
• CVE-2024-25645, published 2024-03-12. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the…
• CVE-2023-28761, published 2023-04-11. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. In SAP NetWeaver Enterprise Portal - version 7.50, an unauthenticated attacker can attach to an open interface and make use of an open API to access a service which will enable them to access or…
• CVE-2023-26461, published 2023-03-14. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed…
• CVE-2022-35298, published 2022-09-13. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack.…
• CVE-2022-35225, published 2022-07-12. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting…
• CVE-2022-35172, published 2022-07-12. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS)…
• CVE-2022-35170, published 2022-07-12. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal does - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting…