CVE-2023-23858

6.1MEDIUM

Key Information:

Vendor
SAP
Status
SAP NetWeaver AS for ABAP and ABAP Platform
Vendor
CVE Published:
14 February 2023

Summary

Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to send a crafted URL to a user, and by clicking the URL, the tricked user accesses SAP and might be directed with the response to somewhere out-side SAP and enter sensitive data. This could cause a limited impact on confidentiality and integrity of the application.

Affected Version(s)

SAP NetWeaver AS for ABAP and ABAP Platform 740

SAP NetWeaver AS for ABAP and ABAP Platform 750

SAP NetWeaver AS for ABAP and ABAP Platform 751

References

https://launchpad.support.sap.com/#/notes/3293786
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.