SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability and integrity.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3287784 | Permissions Required |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Configurations
History
14 Apr 2023, 19:02
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sap
Sap netweaver As Java For Deploy Service |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CPE | cpe:2.3:a:sap:netweaver_as_java_for_deploy_service:7.5:*:*:*:*:*:*:* | |
| References | (MISC) https://launchpad.support.sap.com/#/notes/3287784 - Permissions Required | |
| References | (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory |
11 Apr 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-11 03:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-24527
Mitre link : CVE-2023-24527
CVE.ORG link : CVE-2023-24527
JSON object : View
Products Affected
sap
- netweaver_as_java_for_deploy_service
CWE
CWE-306
Missing Authentication for Critical Function