PT-2023-28365 · Sap · Netweaver As Java Logon

Published 2023-11-13 · Updated 2023-11-20 · CVE-2023-42480

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NetWeaver AS Java Logon application version 7.50

Description The issue allows an unauthenticated attacker to brute force the login functionality, identifying legitimate user ids. This has an impact on confidentiality, with no other impact on integrity or availability.

Recommendations For version 7.50, consider implementing rate limiting or IP blocking to mitigate brute force attacks on the login functionality as a temporary workaround.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2023-42480

Affected Products

Netweaver As Java Logon

References · 7

• https://osv.dev/vulnerability/CVE-2023-42480 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42480 · Security Note
• https://me.sap.com/notes/3366410 · Note
• https://twitter.com/CVEnew/status/1724246599541379082 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1724323400775057537 · Twitter Post
• https://t.me/cvenotify/60818 · Telegram Post