PT-2023-20196 · Sap · Sap Aba

Published 2023-03-14 · Updated 2023-04-11 · CVE-2023-25615

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP ABAP versions 751, 753, 754, 756, 757, 791

Description The issue is caused by insufficient input sanitization, allowing an authenticated high privileged user to alter the current session of the user by injecting malicious database queries over the network. This can lead to a high impact on the confidentiality of the application, with no impact on availability and integrity.

Recommendations For SAP ABAP versions 751, 753, 754, 756, 757, 791, consider restricting access to the database queries to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the functionality that allows injection of database queries over the network until a fix is provided. Restrict access to sensitive data to prevent unintended access.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-25615

Affected Products

Sap Aba

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-25615 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25615 · Vendor Advisory
• https://t.me/cvenotify/46676 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3289844 · Note
• https://t.me/cibsecurity/59948 · Telegram Post