PT-2023-4101 · Sap · Sap Netweaver

Publicado 2023-07-10 · Atualizado 2023-07-19 · CVE-2023-33989

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver (BI CONT ADD ON) versions 707, 737, 747, 757

Description The issue is related to incorrect restriction of a directory path with limited access in the SAP NetWeaver software integration platform. This can be exploited by a remote attacker to overwrite arbitrary files. An attacker with non-administrative authorizations can exploit a directory traversal flaw to overwrite system files, potentially leading to system compromise. However, data from confidential files cannot be read.

Recommendations For SAP NetWeaver (BI CONT ADD ON) versions 707, 737, 747, 757, consider restricting access to the vulnerable directory traversal functionality until a patch is available. As a temporary workaround, avoid using the vulnerable directory traversal function in the affected SAP NetWeaver versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-04409

CVE-2023-33989

Produtos afetados

Sap Netweaver

Referências · 8

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://t.me/cvenotify/54642 · Publicação no Telegram
• https://cybersecurity-help.cz/vdb/SB2023072753 · Nota
• https://me.sap.com/notes/3331376 · Nota
• https://t.me/cvenotify/54038 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33989 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33989 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-04409 · Nota de Segurança