CVEs / CVE-2010-5326
CVE-2010-5326: SAP NetWeaver Remote Code Execution Vulnerability
- Known exploited in the CISA KEV catalog since 3 Nov 2021
- critical 10 CVSS 3.1 (NVD)
- EPSS 17.7% chance of exploitation in the next 30 days, higher than 97% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2010-5326
Summary
SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.
Description
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
Exploitation
| In CISA KEV since | 3 Nov 2021 |
|---|---|
| Due date for US federal agencies | 3 May 2022 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 3.1 | 10 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-306 |
References
- CVE-2010-5326 on NVD
- CVE-2010-5326 in the CISA KEV catalog
- http://service.sap.com/sap/support/notes/1445998 Permissions Required
- http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions Broken Link
- http://www.securityfocus.com/bid/48925 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/90533 Third Party Advisory, VDB Entry
- http://www.us-cert.gov/ncas/alerts/TA16-132A Third Party Advisory, US Government Resource
- https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5326 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.