Server side request forgery (ssrf)

2019-08-1414:15:00

PRIOn knowledge base

www.prio-n.com

9.6 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.8%

JSON

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP Management console, resulting in Server-Side Request Forgery.

CPENameOperatorVersion
netweaver_application_server_javaeq7.30
netweaver_application_server_javaeq7.31
netweaver_application_server_javaeq7.40
netweaver_application_server_javaeq7.50

Name	Operator	Version
netweaver_application_server_java	eq	7.30
netweaver_application_server_java	eq	7.31
netweaver_application_server_java	eq	7.40
netweaver_application_server_java	eq	7.50