PT-2023-21400 · Sap · Abap+1

Published 2023-03-14 · Updated 2023-04-11 · CVE-2023-27893

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Solution Manager and ABAP managed systems (ST-PI) versions 2088 1 700, 2008 1 710, 740

Description An attacker authenticated as a user with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function, allowing them to perform actions they would not normally be permitted to perform. Depending on the function executed, the attack can read or modify any user or application data and can make the application unavailable.

Recommendations For versions 2088 1 700, 2008 1 710, 740, consider restricting access to the vulnerable interface until a patch is available. As a temporary workaround, consider disabling the vulnerable application function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-27893

Affected Products

Abap

Sap Solution Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-27893 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27893 · Vendor Advisory
• https://t.me/cvenotify/46102 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3296476 · Note
• https://t.me/cvenotify/47938 · Telegram Post