PT-2023-19260 · Sap · Sap Netweaver As Abap+1

Published 2023-02-14 · Updated 2023-04-12 · CVE-2023-23860

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790

Description The issue allows an unauthenticated attacker to craft a link, which when clicked by an unsuspecting user, can be used to redirect the user to a malicious site. This could potentially read or modify some sensitive information or expose the victim to a phishing attack.

Recommendations For SAP NetWeaver AS for ABAP and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, consider implementing additional security measures to prevent unauthorized redirections, such as validating user input and implementing robust authentication mechanisms. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2023-23860

Affected Products

Abap Platform

Sap Netweaver As Abap

References · 5

• https://launchpad.support.sap.com/#/notes/3268959 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23860 · Security Note
• https://t.me/cvenotify/48072 · Telegram Post