Sap Netweaver Visual Composer
Monthly
SAP NetWeaver Visual Composer fails to enforce sufficient authorization checks within certain portal functionality, allowing a low-privileged authenticated user to invoke internal operations against a preconfigured remote system; depending on how that remote connection is configured, the attacker could fully compromise the destination system, with high impact on confidentiality, integrity, and availability. The flaw carries a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting the scope change that carries impact from the vulnerable portal into the connected remote system. Exploitation requires a valid low-privileged portal session (not anonymous access) plus an existing preconfigured remote destination reachable through Visual Composer, and there is currently no public exploit identified at time of analysis.
SAP NetWeaver Visual Composer fails to enforce sufficient authorization checks within certain portal functionality, allowing a low-privileged authenticated user to invoke internal operations against a preconfigured remote system; depending on how that remote connection is configured, the attacker could fully compromise the destination system, with high impact on confidentiality, integrity, and availability. The flaw carries a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting the scope change that carries impact from the vulnerable portal into the connected remote system. Exploitation requires a valid low-privileged portal session (not anonymous access) plus an existing preconfigured remote destination reachable through Visual Composer, and there is currently no public exploit identified at time of analysis.