by Kastro
Paper/Archive/CVE-2023-23857

CVE-2023-23857

SAP NetWeaver AS for Java — Improper Access Control in SAP NetWeaver AS for Java

EPSS 0.5%CVSS 9.9
critical.is priorityof 100
39
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 45.7.457 × 209.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and services across systems. On a successful exploitation, the attacker can read and modify some sensitive information but can also be used to lock up any element or operation of the system making that it unresponsive or unavailable.

Affected

ProductAffectedFixed inSource
NetWeaver AS for Java7.50–CNA

Scores by source

sap (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

reflaunchpad.support.sap.com/#/notes/3252433refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html