Back to CVE Browser

CVE-2010-5326

Known Exploited (CISA KEV)CRITICAL

10.0

CVSS Severity Score

EPSS Score57.2480%

EPSS Percentile97.86th

PublishedMay 13, 2016

Last ModifiedApr 22, 2026

Vulnerability Description

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

Affected Platforms (CPE)

📦

Sap

Netweaver Application Server Java

<= 7.30

References & Advisories

🔗 http://service.sap.com/sap/support/notes/1445998

🔗 http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions

🔗 http://www.securityfocus.com/bid/48925

🔗 http://www.securityfocus.com/bid/90533

🔗 http://www.us-cert.gov/ncas/alerts/TA16-132A

🔗 https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications

🔗 http://service.sap.com/sap/support/notes/1445998

🔗 http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions

Related Vulnerabilities

CVE-2021-375359.8

SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform nece...

CVE-2019-03459.8

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overv...

CVE-2019-03898.8

An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5),...

CVE-2015-22827.5

Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP...