ByteOS Network

NVD Vulnerability Details :

CVE-2010-5326

Deferred

Known KEV

More Info Official Page

Source-cve@mitre.org

View Known Exploited Vulnerability (KEV) details

Published At-13 May, 2016 | 10:59

Updated At-12 Apr, 2025 | 10:46

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2021-11-03	2022-05-03	SAP NetWeaver Remote Code Execution Vulnerability	Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Secondary	3.1	10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

SAP SE

>>netweaver_application_server_java>>Versions up to 7.30(inclusive)

cpe:2.3:a:sap:netweaver_application_server_java:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-306	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://service.sap.com/sap/support/notes/1445998	cve@mitre.org	Permissions Required
http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions	cve@mitre.org	Broken Link
http://www.securityfocus.com/bid/48925	cve@mitre.org	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/90533	cve@mitre.org	Third Party Advisory VDB Entry
http://www.us-cert.gov/ncas/alerts/TA16-132A	cve@mitre.org	Third Party Advisory US Government Resource
https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications	cve@mitre.org	Third Party Advisory
http://service.sap.com/sap/support/notes/1445998	af854a3a-2127-422b-91ae-364da2661108	Permissions Required
http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.securityfocus.com/bid/48925	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/90533	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
http://www.us-cert.gov/ncas/alerts/TA16-132A	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory US Government Resource
https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History