Depending on the configuration of the route permission table in file saprouttab, it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.49, KRNL64UC 7.49, SAP_ROUTER 7.53, 7.22, from a remote client, for example stopping the SAProuter, that could highly impact systems availability.
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Netweaver_as_abap | Sap | kernel_7.49 (including) | kernel_7.49 (including) |
Netweaver_as_abap | Sap | kernel_7.77 (including) | kernel_7.77 (including) |
Netweaver_as_abap | Sap | kernel_7.81 (including) | kernel_7.81 (including) |
Netweaver_as_abap | Sap | kernel_7.85 (including) | kernel_7.85 (including) |
Netweaver_as_abap | Sap | kernel_7.86 (including) | kernel_7.86 (including) |
Netweaver_as_abap | Sap | kernel_7.87 (including) | kernel_7.87 (including) |
Netweaver_as_abap | Sap | kernel_7.88 (including) | kernel_7.88 (including) |
Netweaver_as_abap_krnl64nuc | Sap | 7.49 (including) | 7.49 (including) |
Netweaver_as_abap_krnl64uc | Sap | 7.49 (including) | 7.49 (including) |
Router | Sap | 7.22 (including) | 7.22 (including) |
Router | Sap | 7.53 (including) | 7.53 (including) |