Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform (SAP_SE SAP NetWeaver AS ABAP and ABAP Platform)
En bref
- Source
- NVD
- EPSS
- EPSS 0.48 % · centile 42 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Modified
Description
SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 793, SAP_BASIS 804, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read sensitive information which can be used in a subsequent serious attack.
Faiblesses (CWE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | sap |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2023-41379
- GCVE · GCVE-0-2023-37492
Avis du CERT-FR
- CERTFR-2023-AVI-0635 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:757:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:758:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:793:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:804:*:*:*:sap_basis:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP NetWeaver AS ABAP and ABAP Platform | affected SAP_BASIS 700 ; affected SAP_BASIS 701 ; affected SAP_BASIS 702 ; affected SAP_BASIS 731 ; affected SAP_BASIS 740 ; affected SAP_BASIS 750 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |