PT-2023-19258 · Sap · Sap Netweaver As Abap+1

Published 2023-02-14 · Updated 2023-02-21 · CVE-2023-23858

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790

Description The issue is caused by insufficient input validation, allowing an unauthenticated attacker to send a crafted URL to a user. When the user clicks the URL, they may be directed outside the application and potentially enter sensitive data, causing a limited impact on confidentiality and integrity.

Recommendations For SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, consider implementing proper input validation to prevent crafted URLs from being processed. As a temporary workaround, restrict access to external URLs from within the application to minimize the risk of exploitation. Avoid using URLs that may redirect users outside the application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-23858

Affected Products

Abap Platform

Sap Netweaver As Abap

References · 5

• https://osv.dev/vulnerability/CVE-2023-23858 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23858 · Security Note
• https://launchpad.support.sap.com/#/notes/3293786 · Vendor Advisory
• https://t.me/cibsecurity/58054 · Telegram Post