SAP NetWeaver Application Server ABAP, ABAP Platform vulnerabilities

SAP NetWeaver Application Server ABAP and ABAP Platform allow an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may lead to acceptance of tampered identity information and unauthorized access to sensitive user data.

SAP NetWeaver Application Server ABAP and ABAP Platform in versions from 700 to 804 do not perform necessary authorization checks for an authenticated user, resulting in privilege escalation. This could allow an attacker to access sensitive information that can be used in a subsequent serious attack.

SAP NetWeaver Application Server ABAP and ABAP Platform in versions KRNL64NUC, 7.22 and KERNEL 7.22-7.93 perform improper authentication checks for functionalities requiring user identity. As a result, an attacker can perform malicious actions over the network.