CVE-2023-27500CWE-22

Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Critical · published March 14, 2023

CVSS v3.1
9.6
EPSS
1%
Percentile
61.9
In the wild
Unconfirmed
What it is

🚨 A crafty user with just non-admin rights can overwrite critical system files due to a directory traversal flaw in SAPRSBRO! 🔥 Think of it like a delivery driver who can sneak into your warehouse and swap out essential equipment without any authorized access — they can’t steal anything, but they can make your operations grind to a halt! This vulnerability could lead to service disruptions as an attacker could overwrite key OS files, rendering your system completely unavailable. Imagine waking up to find your crucial software just won’t start — absolutely devastating!

Put simply

Think of it like a delivery driver who can sneak into your warehouse and swap out essential equipment without any authorized access — they can’t steal anything, but they can make your operations grind to a halt! This directory traversal issue allows users with non-administrative privileges to manipulate file paths in a way that accesses and overwrites system files, posing a significant availability risk.

What to do

This vulnerability could lead to service disruptions as an attacker could overwrite key OS files, rendering your system completely unavailable. Imagine waking up to find your crucial software just won’t start — absolutely devastating! To protect your system, patch SAPRSBRO to the latest version immediately, and review user permissions to limit non-administrative access. Regular audits of file access controls can also help prevent such exploit scenarios. You’ve got this! Follow these steps, and you’ll have your defenses up in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00982 · 61.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-03-14T05:05Z
EPSS history
Timeline
  • 14 MAR 05:05Z
    Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
    cvelistv5