Back to CVE Browser

CVE-2013-1592

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0910%

EPSS Percentile3.61th

PublishedJan 23, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a remote malicious user execute arbitrary code.

Affected Platforms (CPE)

📦

Sap

Netweaver

= 7.01

📦

Sap

Netweaver

= 7.02

📦

Sap

Netweaver

= 7.30

📦

Sap

Netweaver

= 2004s

References & Advisories

🔗 http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities

🔗 http://www.exploit-db.com/exploits/24511

🔗 http://www.securityfocus.com/bid/57956

🔗 http://www.securitytracker.com/id/1028148

🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/82064

🔗 https://packetstormsecurity.com/files/cve/CVE-2013-1592

🔗 http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities

🔗 http://www.exploit-db.com/exploits/24511

Related Vulnerabilities

CVE-2020-2682910.0

SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections fro...

CVE-2010-532610.0

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, whic...

CVE-2020-628710.0

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which...

CVE-2012-434110.0

Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow remote attackers to cause a denial of serv...