PT-2023-20195 · Sap · Sap Netweaver As Abap

Published 2023-02-14 · Updated 2023-04-12 · CVE-2023-25614

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS ABAP (BSP Framework) versions 700 through 757

Description The SAP NetWeaver AS ABAP (BSP Framework) application allows an unauthenticated attacker to inject code that can be executed by the application over the network. On successful exploitation, it can gain access to sensitive information, leading to a limited impact on the confidentiality and integrity of the application.

Recommendations For versions 700 through 757, apply the necessary security patches or updates to prevent code injection attacks. As a temporary workaround, consider restricting access to the application over the network until a patch is available. Additionally, review and monitor the application's configuration and logs to detect any potential security incidents. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-25614

Affected Products

Sap Netweaver As Abap

References · 7

• https://launchpad.support.sap.com/#/notes/3274585 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25614 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://t.me/cvenotify/44762 · Telegram Post
• https://t.me/cvenotify/48063 · Telegram Post
• https://t.me/cibsecurity/58060 · Telegram Post