CVE-2017-5372

—

CVSS 3.0

7.5 high

EPSS

4%p89

Published

Jan 23, 2017 (Jan 23, 2017)

Modified

Jun 17, 2026

Description

The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system information by leveraging a missing authorization check for the (1) getInformation, (2) getParameters, (3) getServiceInfo, (4) getStatistic, or (5) getClientStatistic function, aka SAP Security Note 2331908.

Vendors: sap
Products: netweaver
Weakness: CWE-200
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (3.5%)

In the news0 stories

No ingested article mentions this CVE yet.