PT-2023-19675 · Sap · Sap Netweaver As Java For Deploy Service

Published 2023-04-11 · Updated 2023-04-14 · CVE-2023-24527

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java for Deploy Service version 7.5

Description The issue allows an unauthenticated attacker to access server settings and data without modifying them, as the system does not perform access control checks for certain functionalities that require user identity. This enables the attacker to attach to an open interface and utilize an open naming and directory API to access a service. The attack has no effect on availability and integrity.

Recommendations For SAP NetWeaver AS Java for Deploy Service version 7.5, consider restricting access to the open interface and the open naming and directory API as a temporary workaround until a patch is available. Additionally, review and implement proper access control checks for functionalities that require user identity to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-24527

Affected Products

Sap Netweaver As Java For Deploy Service

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-24527 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24527 · Security Note
• https://launchpad.support.sap.com/#/notes/3287784 · Note
• https://t.me/cvenotify/47977 · Telegram Post