by Kastro
Paper/Archive/CVE-2023-27500

CVE-2023-27500

SAP NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program) — Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

EPSS 1.0%CVSS 9.6
critical.is priorityof 100
41
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 62.3.623 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. In this attack, no data can be read but potentially critical OS files can be over-written making the system unavailable.

Affected

ProductAffectedFixed inSource
NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)700–CNA
NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)701–CNA
NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)702–CNA
NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)731–CNA
NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)740–CNA
NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)750–CNA
NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)751–CNA
NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)752–CNA
NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)753–CNA
NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)754–CNA
NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)755–CNA
NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program)756–CNA

Scores by source

sap (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reflaunchpad.support.sap.com/#/notes/3302162refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html