PT-2023-5868 · Sap · Sap Netweaver As Java

CVE-2023-42477 · Publicado 2023-10-09 · Atualizado 2023-10-16

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java (GRMG Heartbeat application) version 7.50

Description The issue is related to insufficient validation of incoming requests in the Generic Request and Message Generator (GRMG)/Heartbeat service of the SAP NetWeaver AS for Java platform. This can allow a remote attacker to perform a Server-Side Request Forgery (SSRF) attack, potentially causing limited impact on the confidentiality and integrity of the application.

Recommendations For version 7.50, consider implementing additional validation for incoming requests to the GRMG Heartbeat application to prevent SSRF attacks. As a temporary workaround, restrict access to the vulnerable GRMG/Heartbeat service until a patch is available.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2023-06561

CVE-2023-42477

Produtos afetados

Sap Netweaver As Java

Referências · 8

• https://osv.dev/vulnerability/CVE-2023-42477 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-06561 · Nota de Segurança
• https://t.me/cvenotify/59157 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-42477 · Nota de Segurança
• https://help.sap.com/doc/saphelp_nw73ehp1/7.31.19/en-US/48/b3ea25623035b7e10000000a42189d/content.htm · Nota
• https://me.sap.com/notes/3333426 · Nota
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://t.me/cibsecurity/71884 · Publicação no Telegram