CVE Vulnerability Advisory Database

[Affected Scope] Systems utilizing the SAP NetWeaver Visual Composer Metadata Uploader module

[Impact] A privileged attacker can upload untrusted or malicious content, triggering deserialization of untrusted data (CWE-502) and potentially compromising the confidentiality, integrity, and availability of the host system

[Mitigation] Immediately apply the official security patch (SAP Note 3604119) and restrict access to unauthorized metadata upload endpoints

[Affected Scope] SAP NetWeaver (Visual Composer 7.0 RT) versions 7.30, 7.31, 7.40, and 7.50

[Impact] An authenticated non-administrative attacker can upload malicious files and execute arbitrary OS commands with the privileges of the Java Server process, leading to full system compromise or denial of service

[Mitigation] Immediately apply the official patch specified in SAP Security Note 3084487 and restrict access to vulnerable upload endpoints

[Affected Scope] SAP NetWeaver Application Server Java platforms, typically prior to version 7.3

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and Java code via crafted HTTP/HTTPS requests (CVSS 10.0)

[Mitigation] Apply SAP Note 1445998 and disable the Invoker Servlet globally in the web.xml configuration

[Affected Scope] SAP NetWeaver Application Server Java versions 7.1 through 7.5

[Impact] Unauthenticated remote attackers can read arbitrary system and configuration files by exploiting a directory traversal vulnerability via the 'fileName' parameter

[Mitigation] Apply SAP Security Note 2234971 immediately and restrict external access to the AS Java management console