CVE-2023-29186CWE-22

Directory/Path Traversal vulnerability in SAP NetWeaver.

High · published April 11, 2023

CVSS v3.1

8.7

EPSS

23%

Percentile

97.8

In the wild

Unconfirmed

What it is

In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.

The record

Technical detail

CVSS v3.1: 8.7 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.23035 · 97.8th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2023-04-11T03:08Z

EPSS history

Timeline

11 APR 03:08Z
Directory/Path Traversal vulnerability in SAP NetWeaver.
cvelistv5