CVE-2023-29186— Directory/Path Traversal vulnerability in SAP NetWeaver.
Quick assessment
Affected
SAP NetWeaver (BI CONT ADDON)
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP NetWeaver是德国思爱普（SAP）公司的一套面向服务的集成化应用平台。该平台主要为SAP应用程序提供开发和运行环境。 SAP NetWeaver (BI CONT ADDON) 707、737、747、757版本存在路径遍历漏洞，攻击者利用该漏洞可以上传和覆盖 SAP 服务器上的文件，从而使系统不可用。
Possible ATT&CK Techniques 2 AI
T1083 · File and Directory Discovery T1565.001 · Stored Data Manipulation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-29186
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Directory/Path Traversal vulnerability in SAP NetWeaver.
Source: CVE Program / CVE List V5
Vulnerability Description
In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
SAP NetWeaver 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP NetWeaver是德国思爱普（SAP）公司的一套面向服务的集成化应用平台。该平台主要为SAP应用程序提供开发和运行环境。 SAP NetWeaver (BI CONT ADDON) 707、737、747、757版本存在路径遍历漏洞，攻击者利用该漏洞可以上传和覆盖 SAP 服务器上的文件，从而使系统不可用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP | NetWeaver (BI CONT ADDON) | 707 | - |
|
II. Public POCs for CVE-2023-29186
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-29186
请登录查看更多情报信息。
Other References for CVE-2023-29186 (2)
Same Patch Batch · SAP · 2023-04-11 · 18 CVEs total
| CVE-2023-27497 | 10.0 CRITICAL | Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector) |
| CVE-2023-28765 | 9.8 CRITICAL | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform |
| CVE-2023-27267 | 9.0 CRITICAL | Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge) |
| CVE-2023-26458 | 6.8 MEDIUM | Information Disclosure vulnerability in SAP Landscape Management |
| CVE-2023-29187 | 6.7 MEDIUM | DLL Hijacking vulnerability in SapSetup (Software Installation Program) |
| CVE-2023-28761 | 6.5 MEDIUM | Missing Authentication check in SAP NetWeaver Enterprise Portal |
| CVE-2023-28763 | 6.5 MEDIUM | Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform |
| CVE-2023-27897 | 6.0 MEDIUM | Code Injection vulnerability in SAP CRM |
| CVE-2023-29189 | 5.4 MEDIUM | HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI) |
| CVE-2023-24527 | 5.3 MEDIUM | Improper Access Control in SAP NetWeaver AS Java for Deploy Service |
| CVE-2023-29185 | 5.3 MEDIUM | Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages) |
| CVE-2023-29108 | 5.0 MEDIUM | IP filter vulnerability in ABAP Platform and SAP Web Dispatcher |
| CVE-2023-29109 | 4.4 MEDIUM | Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard) |
| CVE-2023-1903 | 4.3 MEDIUM | Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0) |
| CVE-2023-29110 | 3.7 LOW | Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard) |
| CVE-2023-29112 | 3.7 LOW | Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring) |
| CVE-2023-29111 | 3.1 LOW | Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service |
IV. Related Vulnerabilities
Same vendor: SAP
-
CVE-2023-29189
HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI) -
CVE-2023-29187
DLL Hijacking vulnerability in SapSetup (Software Installati -
CVE-2023-29185
Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Busine -
CVE-2023-29112
Code Injection vulnerability in SAP Application Interface Fr -
CVE-2023-29111
Information Disclosure vulnerability in SAP Application Inte
Same weakness: CWE-22
-
CVE-2026-101295
Oc-mirror: oc-mirror: path traversal / arbitrary file write -
CVE-2026-97242
WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletio -
CVE-2026-96824
WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary -
CVE-2026-94123
WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File D -
CVE-2026-102457
DigiWin｜EasyFlow .NET - Arbitrary File Read
V. Comments for CVE-2023-29186
No comments yet