Versions
KRNL64NUC 7.22EXT
WEBDISP 7.93
WEBDISP 7.22_EXT
KRNL64UC 7.22EXT
WEBDISP 7.85
WEBDISP 7.89
WEBDISP 7.53
WEBDISP 7.54
WEBDISP 7.77
SAP_BASIS 755
KRNL64UC 7.53
KERNEL 7.92
SAP_BASIS 750
KERNEL 7.54
SAP_BASIS 758
SAP_BASIS 753
SAP_BASIS 731
SAP_BASIS 796
KERNEL64UC 7.22EXT
SAP_BASIS740
7.93
7.22EXT
KERNEL64NUC 7.22EXT
KERNEL 7.77
KERNEL 722
KERNEL 7.91
SAP_BASIS 751
KERNEL64UC 7.53
9.12
SAP_BASIS 912
SAP_BASIS 756
SAP_BASIS 754
7.89
SAP_BASIS 702
KERNEL 7.53
SAP_UI 754
KERNEL64NUC 7.22
KERNEL 7.93
SAP_BASIS 752
SAP_BASIS 795
7.54
756
KRNL64NUC 7.22
757
SAP_BASIS 740
7.53
KRNL64UC 7.22
758
SAP_BASIS 701
7.77
SAP_BASIS 757
KERNEL 7.85
KERNEL 7.94
KERNEL 7.89
SAP_BASIS731
755
SAP_BASIS750
KERNEL 7.22
SAP_BASIS 700
KERNEL64UC 7.22
Recent CVEs
CVE-2025-0068
An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.
CVE-2024-54198
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.
CVE-2024-47593
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possible only if a Web Dispatcher or some sort of Proxy Server is in use and the file in question was previously opened or downloaded in an application based on SAP GUI for HTML Technology. This will not compromise the application's integrity or availability.
CVE-2024-41734
Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclosure of user related information. There is no impact on integrity or availability.
CVE-2024-41732
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read or modify information. There is no impact on availability of application.
CVE-2024-33005
Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP Content Server can impersonate other users and may perform some unintended actions. This could lead to a low impact on confidentiality and a high impact on the integrity and availability of the applications.
CVE-2024-33006
An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.
CVE-2024-32733
Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject malicious JavaScript code into the dynamically crafted web page. On successful exploitation the attacker can access or modify sensitive information with no impact on availability of the application
CVE-2023-49581
SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase response times of the AS ABAP, leading to mild impact on availability.
CVE-2023-41366
Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT, allows an unauthenticated attacker to access the unintended data due to the lack of restrictions applied which may lead to low impact in confidentiality and no impact on the integrity and availability of the application.