PT-2023-28365 · Sap · Netweaver As Java Logon

CVE-2023-42480 · Publicado 2023-11-13 · Atualizado 2023-11-20

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NetWeaver AS Java Logon application version 7.50

Description The issue allows an unauthenticated attacker to brute force the login functionality, identifying legitimate user ids. This has an impact on confidentiality, with no other impact on integrity or availability.

Recommendations For version 7.50, consider implementing rate limiting or IP blocking to mitigate brute force attacks on the login functionality as a temporary workaround.

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2023-42480

Produtos afetados

Netweaver As Java Logon

Referências · 7

• https://osv.dev/vulnerability/CVE-2023-42480 · Aviso do Fabricante
• https://me.sap.com/notes/3366410 · Nota
• https://twitter.com/CVEnew/status/1724246599541379082 · Publicação no Twitter
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-42480 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1724323400775057537 · Publicação no Twitter
• https://t.me/cvenotify/60818 · Publicação no Telegram