PT-2023-4140 · Sap · Sap Netweaver Process Integration

Publicado 2023-07-10 · Atualizado 2023-07-19 · CVE-2023-35873

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration version SAP XITOOL 7.50

Description The issue is related to the lack of authentication for a critical function in the Runtime Workbench (RWB) component of SAP NetWeaver Process Integration. This could allow a remote attacker to impact the confidentiality and availability of protected information. The vulnerability may enable an unauthenticated user to access technical data about the product status and its configuration, but it does not allow access to sensitive information or administrative functionalities. The exploitation of this issue can cause limited impact on the confidentiality and availability of the application.

Recommendations For version SAP XITOOL 7.50, consider implementing authentication checks for critical functionalities to prevent unauthorized access. As a temporary workaround, restrict access to technical data about the product status and its configuration until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

BDU:2023-04449

CVE-2023-35873

Produtos afetados

Sap Netweaver Process Integration

Referências · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://me.sap.com/notes/3343547 · Nota
• https://bdu.fstec.ru/vul/2023-04449 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-35873 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-35873 · Nota de Segurança