PT-2023-21176 · Sap · Sap Netweaver As For Abap/Abap Platform

Published 2023-03-14 · Updated 2023-04-11 · CVE-2023-27501

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791

Description The issue allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw in an available service to delete system files. In this attack, no data can be read but potentially critical OS files can be deleted, making the system unavailable and causing significant impact on both availability and integrity.

Recommendations For SAP NetWeaver AS for ABAP and ABAP Platform versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, consider disabling the vulnerable service that allows directory traversal until a patch is available. Restrict access to the system files to minimize the risk of exploitation. Avoid using user-provided path information in the affected service until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-27501

Affected Products

Sap Netweaver As For Abap/Abap Platform

References · 8

• https://osv.dev/vulnerability/CVE-2023-27501 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27501 · Security Note
• https://t.me/cvenotify/46428 · Telegram Post
• https://t.me/cibsecurity/59939 · Telegram Post
• https://t.me/cvenotify/46103 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3294954 · Note
• https://t.me/cvenotify/47939 · Telegram Post