10.0Kritisch
KEV
CVE-2010-5326SAP NetWeaver Remote Code Execution Vulnerability
Bekannt ausgenutzt — SAP NetWeaver Remote Code Execution Vulnerability
CISA hat am 03.11.2021 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 03.05.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2010-5326
Beschreibung
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
Schwachstellentyp (CWE):
CWE-306
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| sap | netweaver application server java | ≤ 7.30 |
Referenzen und Patches
- 90533 vdb-entryThird Party AdvisoryVDB Entry
- https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications Third Party Advisory
- http://service.sap.com/sap/support/notes/1445998
- http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detou… Broken Link
- TA16-132A third-party-advisoryThird Party AdvisoryUS Government Resource
- 48925 vdb-entryThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5326 US Government Resource
CPE-Treffer (NVD) (1)
cpe:2.3:a:sap:netweaver_application_server_java:*:*:*:*:*:*:*:*≤ 7.30