title: Denial of Service (DoS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
description: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in an unused class for error handling in which an attacker authenticated as a non-administrative user can craft a request with certain parameters which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.
problem types: CWE-400: Uncontrolled Resource Consumption
affected:
{
defaultStatus: unaffected
product: NetWeaver AS for ABAP and ABAP Platform
vendor: SAP
versions:
status: affected, version: 700
status: affected, version: 701
status: affected, version: 702
status: affected, version: 731
status: affected, version: 740
status: affected, version: 750
status: affected, version: 751
status: affected, version: 752
status: affected, version: 753
status: affected, version: 754
status: affected, version: 755
status: affected, version: 756
status: affected, version: 757
status: affected, version: 791
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL