Improper Authorization check vulnerability in SAP Message Server (SAP_SE SAP Message Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.53 % · percentile 45 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Modified
Description
The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable.
Weaknesses (CWE)
- CWE-863 — Incorrect Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | sap |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-41378
- GCVE · GCVE-0-2023-37491
CERT-FR advisories
- CERTFR-2023-AVI-0635 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:message_server:kernel_7.22:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:kernel_7.53:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:kernel_7.54:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:kernel_7.77:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:krnl64nuc_7.22:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:krnl64nuc_7.22ex:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:rnl64uc_7.22:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:rnl64uc_7.22ext:*:*:*:*:*:*:*cpe:2.3:a:sap:message_server:rnl64uc_7.53:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP Message Server | affected KERNEL 7.22 ; affected KERNEL 7.53 ; affected KERNEL 7.54 ; affected KERNEL 7.77 ; affected RNL64UC 7.22 ; affected RNL64UC 7.22EXT |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |