SAP Netweaver 7.31

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:sap:netweaver:7.31:*:*:*:*:*:*:*

part: a version: 7.31 update: *

VendorSap (dd5aa0c0-20b0-5c86-a937-aa29f1a33b77)
ProductNetweaver (27ebb32b-037e-5ce8-844e-70d059f1f917)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2022-28217 vulnerable 2026-06-08 05:42:44.235832 Details available
Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSRF attacks that could compromise system�s Availability by causing system to crash.
Published: 2022-06-13T16:04:01.000Z
Updated: 2024-08-03T05:48:37.297Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-38163 vulnerable 2026-06-08 05:32:55.582759 Details available
CRITICAL (9.9)
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
Published: 2021-09-14T11:21:36.000Z
Updated: 2025-10-21T23:25:33.764Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21481 vulnerable 2026-06-08 05:29:12.117546 Details available
CRITICAL (9.6)
The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in complete compromise of system confidentiality, integrity, and availability.
Published: 2021-03-09T14:05:51.000Z
Updated: 2024-08-03T18:16:22.540Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-6285 vulnerable 2026-06-08 05:26:45.006543 Details available
HIGH (7.7)
SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI) (versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50), under certain conditions allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure.
Published: 2020-07-14T12:30:14.000Z
Updated: 2024-08-04T08:55:22.414Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-6203 vulnerable 2026-06-08 05:26:44.718707 Details available
CRITICAL (9.1)
SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs, leading to Path Traversal.
Published: 2020-03-10T20:20:04.000Z
Updated: 2024-08-04T08:55:21.879Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-6181 vulnerable 2026-06-08 05:26:44.651598 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-0351 vulnerable 2026-06-08 05:12:19.752326 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-2477 vulnerable 2026-06-08 05:11:37.228460 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-2476 vulnerable 2026-06-08 05:11:37.226949 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-2470 vulnerable 2026-06-08 05:11:37.218106 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-2464 vulnerable 2026-06-08 05:11:37.205026 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.