CVEブラウザに戻る

CVE-2010-5326

Known Exploited (CISA KEV)CRITICAL

10.0

CVSS Severity Score

EPSS Score57.2480%

EPSS Percentile97.86th

Published2016年5月13日

Last Modified2026年4月22日

Vulnerability Description

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

Affected Platforms (CPE)

📦

Sap

Netweaver Application Server Java

<= 7.30

References & Advisories

🔗 http://service.sap.com/sap/support/notes/1445998

🔗 http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions

🔗 http://www.securityfocus.com/bid/48925

🔗 http://www.securityfocus.com/bid/90533

🔗 http://www.us-cert.gov/ncas/alerts/TA16-132A

🔗 https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications

🔗 http://service.sap.com/sap/support/notes/1445998

🔗 http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions

関連する脆弱性情報

CVE-2021-375359.8

SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform nece...

CVE-2019-03459.8

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overv...

CVE-2019-03898.8

An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5),...

CVE-2015-22827.5

Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP...