PT-2023-19258 · Sap · Sap Netweaver As Abap+1

CVE-2023-23858 · Publicado 2023-02-14 · Atualizado 2023-02-21

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790

Description The issue is caused by insufficient input validation, allowing an unauthenticated attacker to send a crafted URL to a user. When the user clicks the URL, they may be directed outside the application and potentially enter sensitive data, causing a limited impact on confidentiality and integrity.

Recommendations For SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, consider implementing proper input validation to prevent crafted URLs from being processed. As a temporary workaround, restrict access to external URLs from within the application to minimize the risk of exploitation. Avoid using URLs that may redirect users outside the application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-23858

Produtos afetados

Abap Platform

Sap Netweaver As Abap

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-23858 · Aviso do Fabricante
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://t.me/cibsecurity/58054 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-23858 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/3293786 · Aviso do Fabricante