Actively exploited · Published May 13, 2016 · Assigned by mitre
CVE-2010-5326
Critical 10.0 Exploited
In plain English
A critical-severity missing authentication in NetWeaver from SAP. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 17.8% (higher than 97% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- 90533 vdb-entry, x_refsource_BID
- https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications x_refsource_MISC
- http://service.sap.com/sap/support/notes/1445998 x_refsource_MISC
- http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions x_refsource_MISC
- TA16-132A third-party-advisory, x_refsource_CERT
- 48925 vdb-entry, x_refsource_BID
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5326 government-resource