CVE-2023-29186

CWE-22 — Path Traversal3 documents3 sources
Severity
6.5MEDIUM
EPSS
23.1%
top 4.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP Netweaver (BI Cont Addon)SAP Netweaver
Timeline
PublishedApr 11
Latest updateJul 6

Description

In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:HExploitability: 2.3 | Impact: 5.8

Affected Packages2 packages

▶CVEListV5sap/netweaver_(bi_cont_addon)4 versions+3
▶NVDsap/netweaver4 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-6j2v-3cg6-9w64: In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite↗2023-07-06
▶
CVEList
Directory/Path Traversal vulnerability in SAP NetWeaver.↗2023-04-11
▶