PT-2023-19259 · Sap · Sap Netweaver As For Abap/Abap Platform

Published 2023-02-14 · Updated 2023-04-12 · CVE-2023-23859

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790

Description The issue allows an unauthenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information.

Recommendations For versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, consider implementing additional security measures to prevent malicious link attacks, such as validating user input and implementing clickjacking protection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-23859

Affected Products

Sap Netweaver As For Abap/Abap Platform

References · 6

• https://launchpad.support.sap.com/#/notes/3268959 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23859 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23859 · Security Note
• https://t.me/cibsecurity/58063 · Telegram Post
• https://t.me/cvenotify/48073 · Telegram Post