PT-2023-21046 · Sap · Sap Netweaver As Java

Published 2023-03-14 · Updated 2023-04-11 · CVE-2023-27268

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java (Object Analyzing Service) version 7.50

Description The issue allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service. This enables them to access server settings and data without modifying them, resulting in escalation of privileges. The issue does not affect availability.

Recommendations For version 7.50, apply the necessary authorization checks to prevent unauthenticated access to the open interface and naming and directory API. As a temporary workaround, consider restricting access to the open interface and API until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-27268

Affected Products

Sap Netweaver As Java

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27268 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27268 · Security Note
• https://t.me/cibsecurity/59957 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3288480 · Note