PT-2023-15953 · Sap · Sap Netweaver

Published 2023-03-14 · Updated 2023-03-16 · CVE-2023-0021

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 700 through 750

Description The issue is caused by insufficient encoding of user input, allowing an unauthenticated attacker to inject code. This can expose sensitive data, such as user id and password, and may lead to reflected Cross-Site scripting. The affected endpoints are typically exposed over the network, and successful exploitation can partially impact the confidentiality of the application.

Recommendations For SAP NetWeaver versions 700 through 750, update to a version that includes proper encoding of user input to prevent code injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-0021

Affected Products

Sap Netweaver

References · 4

• https://osv.dev/vulnerability/CVE-2023-0021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0021 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3274920 · Note