PT-2023-19674 · Sap · Sap Netweaver Application Server Java

Published 2023-03-14 · Updated 2023-04-11 · CVE-2023-24526

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java for Classload Service version 7.50

Description The issue results in escalation of privileges due to the lack of authentication checks for functionalities that require user identity. This has a low impact on data confidentiality, allowing an unassigned user to read non-sensitive server data.

Recommendations For SAP NetWeaver Application Server Java for Classload Service version 7.50, consider implementing proper authentication checks for functionalities that require user identity to prevent escalation of privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-24526

Affected Products

Sap Netweaver Application Server Java

References · 5

• https://osv.dev/vulnerability/CVE-2023-24526 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24526 · Security Note
• https://launchpad.support.sap.com/#/notes/3288394 · Note
• https://t.me/cibsecurity/59949 · Telegram Post