CVE-2010-5326

Katalog CVE

CVSS 10.0 · Critical KEV · sudah dieksploitasi EPSS 17,8%

Kerentanan Missing Authentication for Critical Function pada sap netweaver application server java. Skor CVSS 3.1 10.0 (Critical) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

Rincian

Terbit di NVD

13 Mei 2016

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

17,8% peluang dieksploitasi; lebih tinggi dari 97,1% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

SAP NetWeaver Remote Code Execution Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.us-cert.gov/ncas/alerts/TA16-132A advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5326 pemerintah AS
• http://www.securityfocus.com/bid/48925 advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/90533 advisory pihak ketiga · vdb entry
• https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications advisory pihak ketiga
• http://service.sap.com/sap/support/notes/1445998 permissions required
• http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour... broken link