description: SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce the web server into authenticating with the malicious server. Furthermore, if NTLM is setup the attacker can compromise confidentiality, integrity and availability of the SAP database.
problem types: Server Side Request Forgery
affected:
{
product: SAP Netweaver AS ABAP
vendor: SAP SE
versions:
status: affected, version: < 700
status: affected, version: < 701
status: affected, version: < 702
status: affected, version: < 710
status: affected, version: < 711
status: affected, version: < 730
status: affected, version: < 731
status: affected, version: < 740
status: affected, version: < 750
status: affected, version: < 751
status: affected, version: < 752
status: affected, version: < 753
status: affected, version: < 754
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.0
]