« Volver al listado

CVE-2013-6820

Estado: ModificadaAlta (9.3)—

Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure (NWDI) allows remote attackers to execute arbitrary code by uploading a file with an executable extension via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Netweaver Development Infrastructure

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-6820",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-11-20T14:12:30.977",
  "references": [
    {
      "url": "http://scn.sap.com/docs/DOC-8218",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://erpscan.io/advisories/dsecrg-13-004-sap-netweaver-di-arbitrary-file-upload/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://service.sap.com/sap/support/notes/1757675",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://scn.sap.com/docs/DOC-8218",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://erpscan.io/advisories/dsecrg-13-004-sap-netweaver-di-arbitrary-file-upload/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://service.sap.com/sap/support/notes/1757675",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure (NWDI) allows remote attackers to execute arbitrary code by uploading a file with an executable extension via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de subida de archivos sin restricción en el SAP NetWeaver Development Infrastructure (NWDI) permite a atacantes remotos ejecutar código arbitrario mediante la subida de un archivo con una extensión ejecutable a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T00:00:59.467",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver_development_infrastructure:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D95FE186-7CCA-4B8C-85D1-08764F16498D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "Per:  http://cwe.mitre.org/data/definitions/434.html\n\n\"CWE-434: Unrestricted Upload of File with Dangerous Type\"",
  "sourceIdentifier": "cve@mitre.org",
  "evaluatorSolution": "Per:  http://erpscan.com/advisories/dsecrg-13-004-sap-netweaver-di-arbitrary-file-upload/\n\n\"The vulnerability can lead to uploading any file to SAP web server without authorization. An attacker can use it to upload a backdoor and obtain full access to SAP system. \""
}