Vulnerability · Published Apr 11, 2023 · Assigned by sap
CVE-2023-29186Directory/Path Traversal vulnerability in SAP NetWeaver.
High 8.7
In plain English
A high-severity path traversal in NetWeaver (BI CONT ADDON) from SAP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 23.0% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)8.7High
Exploit odds (30 days)23.0%top 2.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP | NetWeaver (BI CONT ADDON) | 707737747757 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H