PT-2021-7578 · Sap · Sap Netweaver As Java

Published 2021-01-09 · Updated 2023-01-13 · CVE-2023-0017

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS for Java version 7.50

Description The issue is related to improper access control in SAP NetWeaver AS for Java, allowing an unauthenticated attacker to attach to an open interface and utilize an open naming and directory API. This can lead to unauthorized operations affecting users and data on the current system, potentially granting the attacker full read access to user data, enabling modifications to user data, and making services within the system unavailable.

Recommendations For SAP NetWeaver AS for Java version 7.50, consider restricting access to the open interface and the open naming and directory API until a patch is available. As a temporary workaround, limit the services that can be accessed through these interfaces to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-00120

CVE-2023-0017

Affected Products

Sap Netweaver As Java

References · 7

• https://osv.dev/vulnerability/CVE-2023-0017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0017 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00120 · Security Note
• https://launchpad.support.sap.com/#/notes/3268093 · Vendor Advisory
• https://t.me/cibsecurity/56209 · Telegram Post
• https://t.me/cvenotify/41953 · Telegram Post