CVE-2023-23858

Published Feb 14, 2023

Last updated a year ago

Overview

Description: Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to send a crafted URL to a user, and by clicking the URL, the tricked user accesses SAP and might be directed with the response to somewhere out-side SAP and enter sensitive data. This could cause a limited impact on confidentiality and integrity of the application.
Source: cna@sap.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

cna@sap.com: CWE-79

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "127E508F-6CC1-41C8-96DF-8D14FFDD4020"
          },
          {
            "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7777AA80-1608-420E-B7D5-09ABECD51728"
          },
          {
            "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0539618A-1C4D-463F-B2BB-DD1C239C23EB"
          },
          {
            "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "62828DCD-F80E-4C7C-A988-EFEA06A5223E"
          },
          {
            "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D9F38585-73AE-4DBB-A978-F0272DF8FB58"
          },
          {
            "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D416C064-BB8A-4230-A761-84A93E017F79"
          },
          {
            "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6B8D3EA0-28E6-4333-8C67-B9D3775EB9BC"
          },
          {
            "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "72491771-4492-4902-9F0C-CE6A60BAA705"
          },
          {
            "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:757:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "421A5354-F764-402B-A3A4-2D746EACEB46"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References