Heap-based buffer overflow in the Message HTTP Server in SAP Message Server allows remote attackers to execute arbitrary code via a long st…

published 2007-07-09 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-3608

cvss: 10.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 37.4%; EPSS 37.4% chance of exploitation in 30 days, percentile 98%
public exploits: 1; Exploit-DB

Heap-based buffer overflow in the Message HTTP Server in SAP Message Server allows remote attackers to execute arbitrary code via a long string in the group parameter to /msgserver/html/group.

Patch / fix

links 1

secunia.com/advisories/25966 advisory

Timeline

2007-07-05 First public exploit (EDB-30265)
2007-07-09 Published

Exploit prediction

37.42% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-30265 SAP Message Server - 'Group' Remote Buffer Overflow remote, 2007-07-05
securityfocus.com http://www.securityfocus.com/bid/24765 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

References

secunia.com /advisories/25966
third-party-advisory, patch, vendor-advisory
securityfocus.com /bid/24765
vdb-entry, exploit
securitytracker.com /id?1018340
vdb-entry
marc.info /?l=bugtraq&m=118365794615827&w=2
mailing-list
vupen.com /english/advisories/2007/2451
vdb-entry
osvdb.org /38096
vdb-entry
exchange.xforce.ibmcloud.com /vulnerabilities/35279
vdb-entry
ngssoftware.com /advisories/critical-risk-vulnerability-in-sap-message-server-heap-overflow/
kb.cert.org /vuls/id/305657
third-party-advisory, us-government-resource

Sources

CVE List CVE-2007-3624
NVD CVE-2007-3624

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary