Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3269151 | Permissions Required Vendor Advisory |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
11 Apr 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application. |
21 Feb 2023, 19:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory | |
| References | (MISC) https://launchpad.support.sap.com/#/notes/3269151 - Permissions Required, Vendor Advisory | |
| First Time |
Sap netweaver As Abap Business Server Pages
Sap |
|
| CPE | cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:750:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:754:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:752:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:756:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:701:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:740:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:731:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:702:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:751:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:753:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:700:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:757:*:*:*:*:*:*:* cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:755:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
14 Feb 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-14 04:15
Updated : 2023-12-10 14:48
NVD link : CVE-2023-24521
Mitre link : CVE-2023-24521
CVE.ORG link : CVE-2023-24521
JSON object : View
Products Affected
sap
- netweaver_as_abap_business_server_pages
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')