{"advisories":[{"id":"EUVD-2017-18754","source":"euvd","title":"SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804.","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-18754"}],"cve":"CVE-2017-9844","epss":{"score":0.05365},"mitre":{"cpes":[],"created":"2017-07-12T16:00:00+00:00","description":"SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer deserializes a malicious object that may cause legitimate users accessing a service, either by crashing or flooding the service.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2017/9xxx/CVE-2017-9844.json","references":["http://www.securityfocus.com/bid/96865","https://erpscan.io/advisories/erpscan-17-014-sap-netweaver-java-deserialization-untrusted-user-value-metadatauploader/","https://me.sap.com/notes/2399804"],"title":null,"updated":"2025-05-01T14:35:03.522000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:a:sap:netweaver:7400.12.21.30308:*:*:*:*:*:*:*"],"created":"2017-07-12T16:29:00.420000+00:00","description":"SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer deserializes a malicious object that may cause legitimate users accessing a service, either by crashing or flooding the service.","metrics":{"cvssV2_0":{"score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2017/CVE-2017-9844.json","references":["http://www.securityfocus.com/bid/96865","https://erpscan.io/advisories/erpscan-17-014-sap-netweaver-java-deserialization-untrusted-user-value-metadatauploader/","https://me.sap.com/notes/2399804"],"title":null,"updated":"2026-06-17T01:29:01.863000+00:00","vendors":["sap","sap$PRODUCT$netweaver"],"weaknesses":["CWE-502"]},"opencve":{"changes":[{"created":"2025-05-01T14:45:00+00:00","data":[{"details":{"new":"SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer deserializes a malicious object that may cause legitimate users accessing a service, either by crashing or flooding the service.","old":"SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804."},"type":"description"},{"details":{"added":["https://me.sap.com/notes/2399804"],"removed":[]},"type":"references"}],"id":"453a9d80-11d1-45c8-be17-e7e38e582865"},{"created":"2025-05-02T15:45:00+00:00","data":[{"details":{"added":{"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}},"removed":{"cvssV3_0":{"score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}},"updated":{}},"type":"metrics"}],"id":"ee183c6f-eaec-48bb-b9dc-30de679e573e"}],"cpes":{"data":["cpe:2.3:a:sap:netweaver:7400.12.21.30308:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2017-07-12T16:00:00+00:00","provider":"mitre"},"description":{"data":"SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer deserializes a malicious object that may cause legitimate users accessing a service, either by crashing or flooding the service.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{"score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},"provider":"nvd"},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"provider":"nvd"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.05365},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["http://www.securityfocus.com/bid/96865","https://erpscan.io/advisories/erpscan-17-014-sap-netweaver-java-deserialization-untrusted-user-value-metadatauploader/","https://me.sap.com/notes/2399804"],"providers":["mitre","nvd"]},"title":{"data":null,"provider":null},"updated":{"data":"2025-05-02T15:25:18.377000+00:00","provider":"nvd"},"vendors":{"data":["sap","sap$PRODUCT$netweaver"],"providers":["nvd"]},"weaknesses":{"data":["CWE-502"],"providers":["nvd"]}}}