by Kastro
Paper/Archive/CVE-2023-0014

CVE-2023-0014

SAP NetWeaver ABAP Server and ABAP Platform — Capture-replay vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.6.536 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates information about system identity in an ambiguous format. This could lead to capture-replay vulnerability and may be exploited by malicious users to obtain illegitimate access to the system.

Affected

ProductAffectedFixed inSource
NetWeaver ABAP Server and ABAP PlatformSAP_BASIS 701–CNA
NetWeaver ABAP Server and ABAP PlatformSAP_BASIS 702–CNA
NetWeaver ABAP Server and ABAP PlatformSAP_BASIS 710–CNA
NetWeaver ABAP Server and ABAP PlatformSAP_BASIS 711–CNA
NetWeaver ABAP Server and ABAP PlatformSAP_BASIS 730–CNA
NetWeaver ABAP Server and ABAP PlatformSAP_BASIS 731–CNA
NetWeaver ABAP Server and ABAP PlatformSAP_BASIS 740–CNA
NetWeaver ABAP Server and ABAP PlatformSAP_BASIS 750–CNA
NetWeaver ABAP Server and ABAP PlatformSAP_BASIS 751–CNA
NetWeaver ABAP Server and ABAP PlatformSAP_BASIS 752–CNA
NetWeaver ABAP Server and ABAP PlatformSAP_BASIS 753–CNA
NetWeaver ABAP Server and ABAP PlatformSAP_BASIS 754–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
sap (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reflaunchpad.support.sap.com/#/notes/3089413refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html