CVE-2010-5326

CriticalCVSS 10.0/10Known exploited (CISA KEV)Last modified Jun 16, 2026

Description

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://service.sap.com/sap/support/notes/1445998Permissions Required
http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutionsBroken Link
http://www.securityfocus.com/bid/48925Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/90533Third Party Advisory, VDB Entry
http://www.us-cert.gov/ncas/alerts/TA16-132AThird Party Advisory, US Government Resource
https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applicationsThird Party Advisory
http://service.sap.com/sap/support/notes/1445998Permissions Required
http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutionsBroken Link
http://www.securityfocus.com/bid/48925Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/90533Third Party Advisory, VDB Entry
http://www.us-cert.gov/ncas/alerts/TA16-132AThird Party Advisory, US Government Resource
https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applicationsThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5326US Government Resource

Timeline

Published: May 13, 2016
Last modified: Jun 16, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2010

CVE-2010-53278.8Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.CVE-2010-53285.5include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group ID of zero from reaching the swapp CVE-2010-53295.5The video_usercopy function in drivers/media/video/v4l2-ioctl.c in the Linux kernel before 2.6.39 relies on the count value of a v4l2_ext_co CVE-2010-53309.8On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not CVE-2010-53317.8In the Linux kernel before 2.6.34, a range check issue in drivers/gpu/drm/radeon/atombios.c could cause an off by one (buffer overflow) prob CVE-2010-53325.6In the Linux kernel before 2.6.37, an out of bounds array access happened in drivers/net/mlx4/port.c. When searching for a free entry in eit CVE-2010-53339.8The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an admini CVE-2010-53347.5IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver CVE-2010-53357.5IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver CVE-2010-53366.1IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persistent in 10.2.0.CVE-2010-53376.1IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persist CVE-2010-53386.1IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action] is non-persistent