9.8crit
CVE-2017-11459
SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently exec…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.4%
percentile 84%
Public exploits
0
none known
Summary
SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execute arbitrary code via an fdir command, aka SAP Security Note 2419592.
Exploit prediction (EPSS)
2.35% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-94 Improper Control of Generation of Code
References
- erpscan.io /advisories/erpscan-17-019-sap-trex-rce/ · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-11459
- NVD: CVE-2017-11459
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.