CVE-2013-1592

A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a remote malicious user execute arbitrary code.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

24.41% chance of exploitation in the next 30 days, 98th percentile

Published

2020-01-23

Updated

2024-08-06

Proof-of-concept exploits (2)

• http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities
• http://www.exploit-db.com/exploits/24511

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/24511

References

• CVE Record
• NVD entry

Related

• CVE-2013-1559
• CVE-2013-1593
• CVE-2013-1509
• CVE-2013-1594
• CVE-2013-1493
• CVE-2013-1595