Read the docs

SAP

Records1968All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical221CVSS 9.0–10.0
CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV
TI-2025-27866 SAP NetWeaver Deserialization Vulnerability Priority CRITICAL 98KEV 2025-05-15TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability Priority CRITICAL 100KEV 2025-04-29TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability Priority CRITICAL 90KEV 2025-03-19TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability Priority CRITICAL 100KEV 2024-09-30TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability Priority CRITICAL 100KEV 2022-08-18TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability Priority CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records
3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

8 records in Cloud Connector · all components

TI-2024-16870 CVE-2024-25642 · GHSA-ggv5-38c7-p4jr

Improper Certificate Validation in SAP Cloud Connector

Priority HIGH 68

Due to improper validation of certificate in SAP Cloud Connector - version 2.0, attacker can impersonate the genuine servers to interact with SCC breaking the mutual authentication.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00544 Published 2024-02-13 No fix listed CWE-295
TI-2019-00215 CVE-2019-0246 · GHSA-77vc-6vmv-4mv7

Missing authentication in SAP Cloud Connector

Priority MEDIUM 47

SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02744 Published 2019-01-08 Fixed in 2.11.3 CWE-306
TI-2019-00216 CVE-2019-0247 · GHSA-xvr6-m6gq-m42f

Code injection in SAP Cloud Connector

Priority MEDIUM 45

SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01272 Published 2019-01-08 Fixed in 2.11.3 CWE-94
TI-2021-13069 CVE-2021-33695 · GHSA-4mf2-c3h2-mq3p

Improper certificate validation in SAP Cloud Connector

Priority MEDIUM 40

Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00559 Published 2021-09-15 Fixed in 2.0 CWE-297
TI-2021-13066 CVE-2021-33692 · GHSA-4p7q-px7w-p3p9

Path traversal in SAP Cloud Connector

Priority LOW 35

SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0117 Published 2021-09-15 Fixed in 2.0 CWE-22
TI-2021-13067 CVE-2021-33693 · GHSA-wpcw-xfjj-3ghr

Code injection in SAP Cloud Connector

Priority LOW 31

SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that could potentially lead to OS command execution.

CVSS 3.1MEDIUM 6.8 Adjacent network High privileges No interaction EPSS 0.0054 Published 2021-09-15 Fixed in 2.0 CWE-94
TI-2021-13068 CVE-2021-33694 · GHSA-f42x-6gqm-cmqq

Cross-site scripting in SAP Cloud Connector

Priority LOW 22

SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious codes that get stored in the database, and when accessed, coul…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00465 Published 2021-09-15 Fixed in 2.0 CWE-79
TI-2023-27077 CVE-2023-49578 · GHSA-8pr4-262g-crh2

Denial of service (DOS) in SAP Cloud Connector

Priority LOW 16

SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious request which leads to low impact on the availability and no…

CVSS 3.1LOW 3.5 Adjacent network Low privileges No interaction EPSS 0.0027 Published 2023-12-12 No fix listed CWE-732
Open these records in search →