PT-2023-1711 · Sap · Sap Netweaver Application Server For Abap/Abap Platform

Published 2023-02-27 · Updated 2023-04-11 · CVE-2023-27269

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791

Description The issue is related to a directory traversal flaw in an available service, allowing an attacker with non-administrative authorizations to overwrite system files. This attack does not allow data to be read, but potentially critical OS files can be overwritten, making the system unavailable. The flaw is due to incorrect restriction of the path name to a directory with limited access.

Recommendations For SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, consider disabling the vulnerable service until a patch is available to prevent exploitation of the directory traversal flaw. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Path traversal

Weakness Enumeration

CWE-862

CWE-22

Related Identifiers

BDU:2023-01289

CVE-2023-27269

Affected Products

Sap Netweaver Application Server For Abap/Abap Platform

References · 9

• https://bdu.fstec.ru/vul/2023-01289 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27269 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27269 · Security Note
• https://anti-malware.ru/news/2023-03-15-114534/40725 · Note
• https://vuldb.com/ru/?id.222924 · Note
• https://launchpad.support.sap.com/#/notes/3294595 · Note
• https://t.me/cvenotify/47942 · Telegram Post
• https://t.me/true_secator/4175 · Telegram Post