Improper Authorization check vulnerability in SAP Message Server (SAP_SE SAP Message Server)
En bref
- Source
- NVD
- EPSS
- EPSS 0.53 % · centile 45 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Modified
Rechercher sur…
Description
The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable.
Faiblesses (CWE)
- CWE-863 — Autorisation incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | sap |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2023-41378
- GCVE · GCVE-0-2023-37491
Avis du CERT-FR
- CERTFR-2023-AVI-0635 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:message_server:kernel_7.22:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:kernel_7.53:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:kernel_7.54:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:kernel_7.77:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:krnl64nuc_7.22:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:krnl64nuc_7.22ex:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:rnl64uc_7.22:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:rnl64uc_7.22ext:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:rnl64uc_7.53:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP Message Server | affected KERNEL 7.22 ; affected KERNEL 7.53 ; affected KERNEL 7.54 ; affected KERNEL 7.77 ; affected RNL64UC 7.22 ; affected RNL64UC 7.22EXT |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |