10.0Critical
KEV
CVE-2010-5326SAP NetWeaver Remote Code Execution Vulnerability
Known exploited — SAP NetWeaver Remote Code Execution Vulnerability
CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 03.05.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2010-5326
Description
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
Weakness (CWE):
CWE-306
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| sap | netweaver application server java | ≤ 7.30 |
References and patches
- 90533 vdb-entryThird Party AdvisoryVDB Entry
- https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications Third Party Advisory
- http://service.sap.com/sap/support/notes/1445998
- http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detou… Broken Link
- TA16-132A third-party-advisoryThird Party AdvisoryUS Government Resource
- 48925 vdb-entryThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5326 US Government Resource
CPE matches (NVD) (1)
cpe:2.3:a:sap:netweaver_application_server_java:*:*:*:*:*:*:*:*≤ 7.30