{"api_version":"1","generated_at":"2026-07-23T10:21:14+00:00","cve":"CVE-2013-6814","urls":{"html":"https://cve.report/CVE-2013-6814","api":"https://cve.report/api/cve/CVE-2013-6814.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-6814","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-6814"},"summary":{"title":"CVE-2013-6814","description":"The J2EE Engine in SAP NetWeaver 6.40, 7.02, and earlier allows remote attackers to redirect users to arbitrary web sites, conduct phishing attacks, and obtain sensitive information (cookies and SAPPASSPORT) via unspecified vectors.","state":"PUBLISHED","assigner":"mitre","published_at":"2013-11-20 14:12:30","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-20","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://erpscan.io/advisories/erpscan-13-021-sap-portal-unvalidated-redirect/","name":"https://erpscan.io/advisories/erpscan-13-021-sap-portal-unvalidated-redirect/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[ERPSCAN-13-021] SAP Portal - Unvalidated redirect","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://scn.sap.com/docs/DOC-8218","name":"http://scn.sap.com/docs/DOC-8218","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Acknowledgments to Security Researchers | SCN","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://service.sap.com/sap/support/notes/1854826","name":"https://service.sap.com/sap/support/notes/1854826","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/55778","name":"http://secunia.com/advisories/55778","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Advisory SA55778 - SAP Netweaver Web Application Server J2EE SAP Portal Redirection Weakness - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6814","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6814","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"6814","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"netweaver","cpe6":"6.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"6814","vulnerable":"1","versionEndIncluding":"7.02","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"netweaver","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2013","cve_id":"6814","cve":"CVE-2013-6814","epss":"0.003070000","percentile":"0.538620000","score_date":"2026-04-29","updated_at":"2026-04-30 00:13:22"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T17:46:23.716Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://service.sap.com/sap/support/notes/1854826"},{"name":"55778","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/55778"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://scn.sap.com/docs/DOC-8218"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://erpscan.io/advisories/erpscan-13-021-sap-portal-unvalidated-redirect/"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-10-30T00:00:00.000Z","descriptions":[{"lang":"en","value":"The J2EE Engine in SAP NetWeaver 6.40, 7.02, and earlier allows remote attackers to redirect users to arbitrary web sites, conduct phishing attacks, and obtain sensitive information (cookies and SAPPASSPORT) via unspecified vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-12-10T17:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://service.sap.com/sap/support/notes/1854826"},{"name":"55778","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/55778"},{"tags":["x_refsource_CONFIRM"],"url":"http://scn.sap.com/docs/DOC-8218"},{"tags":["x_refsource_MISC"],"url":"https://erpscan.io/advisories/erpscan-13-021-sap-portal-unvalidated-redirect/"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2013-6814","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The J2EE Engine in SAP NetWeaver 6.40, 7.02, and earlier allows remote attackers to redirect users to arbitrary web sites, conduct phishing attacks, and obtain sensitive information (cookies and SAPPASSPORT) via unspecified vectors."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://service.sap.com/sap/support/notes/1854826","refsource":"CONFIRM","url":"https://service.sap.com/sap/support/notes/1854826"},{"name":"55778","refsource":"SECUNIA","url":"http://secunia.com/advisories/55778"},{"name":"http://scn.sap.com/docs/DOC-8218","refsource":"CONFIRM","url":"http://scn.sap.com/docs/DOC-8218"},{"name":"https://erpscan.io/advisories/erpscan-13-021-sap-portal-unvalidated-redirect/","refsource":"MISC","url":"https://erpscan.io/advisories/erpscan-13-021-sap-portal-unvalidated-redirect/"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2013-6814","datePublished":"2013-11-19T19:00:00.000Z","dateReserved":"2013-11-19T00:00:00.000Z","dateUpdated":"2024-08-06T17:46:23.716Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-11-20 14:12:30","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-20","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sap:netweaver:*:*:*:*:*:*:*:*","versionEndIncluding":"7.02","matchCriteriaId":"2AFD395C-99B0-4AA2-AF4D-5D29076ED6E2"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:netweaver:6.4:*:*:*:*:*:*:*","matchCriteriaId":"A35F93E3-FC19-4A52-885A-AA2112CAF34D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"6814","Ordinal":"1","Title":"CVE-2013-6814","CVE":"CVE-2013-6814","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"6814","Ordinal":"1","NoteData":"The J2EE Engine in SAP NetWeaver 6.40, 7.02, and earlier allows remote attackers to redirect users to arbitrary web sites, conduct phishing attacks, and obtain sensitive information (cookies and SAPPASSPORT) via unspecified vectors.","Type":"Description","Title":"CVE-2013-6814"},{"CveYear":"2013","CveId":"6814","Ordinal":"2","NoteData":"2013-11-19","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"6814","Ordinal":"3","NoteData":"2018-12-10","Type":"Other","Title":"Modified"}]}}}