An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data on the current system. This could allow the attacker to have full read access to user data, make modifications to user data, and make services within the system unavailable.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3268093 | Permissions Required Vendor Advisory |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Configurations
History
13 Jan 2023, 18:18
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sap
Sap netweaver Application Server For Java |
|
| CPE | cpe:2.3:a:sap:netweaver_application_server_for_java:7.50:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| References | (MISC) https://launchpad.support.sap.com/#/notes/3268093 - Permissions Required, Vendor Advisory | |
| References | (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory |
10 Jan 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-01-10 04:15
Updated : 2023-12-10 14:48
NVD link : CVE-2023-0017
Mitre link : CVE-2023-0017
CVE.ORG link : CVE-2023-0017
JSON object : View
Products Affected
sap
- netweaver_application_server_for_java
CWE
CWE-284
Improper Access Control