Описание
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
Ссылки
- Permissions Required
- Broken Link
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryUS Government Resource
- Third Party Advisory
- Permissions Required
- Broken Link
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryUS Government Resource
- Third Party Advisory
Уязвимые конфигурации
EPSS
10 Critical
CVSS3
10 Critical
CVSS2
Дефекты
Связанные уязвимости
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
Уязвимость компонента Invoker Servlet сервера веб-приложений SAP NetWeaver Java Application Server, позволяющая нарушителю выполнить произвольный код или получить полный контроль над системой
EPSS
10 Critical
CVSS3
10 Critical
CVSS2