SAP Sapcar vulnerabilities

3 CVEs affecting SAP Sapcar, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-26100, published 2022-03-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-8852, published 2017-05-10. High severity, CVSS 7.8. EPSS: 3.3% chance of exploitation in the next 30 days. SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted CAR archive file received from an untrusted remote source. The problem is that the length of…
CVE-2016-5845, published 2016-08-13. Medium severity, CVSS 5.5. EPSS: 3% chance of exploitation in the next 30 days. SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to cause a denial of service (program crash) via an invalid file name in an archive…
CVE-2022-26100, published 2022-03-10. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obtain privileged access to the system.