PT-2023-3747 · Sap · Sap Plant Connectivity+1

Published 2023-06-13 · Updated 2023-06-26 · CVE-2023-2827

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Plant Connectivity version 15.5 Production Connector for SAP Digital Manufacturing version 1.0

Description The issue is related to the lack of validation of the signature of the JSON Web Token (JWT) in HTTP requests sent from SAP Digital Manufacturing. This could allow unauthorized callers from the internal network to send service requests, potentially impacting the integrity of the integration with SAP Digital Manufacturing.

Recommendations For SAP Plant Connectivity version 15.5, update to a version that includes a fix for the issue with JSON Web Token validation. For Production Connector for SAP Digital Manufacturing version 1.0, update to a version that includes a fix for the issue with JSON Web Token validation. As a temporary workaround, consider restricting access to the vulnerable components to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-04035

CVE-2023-2827

Affected Products

Production Connector For Sap Digital Manufacturing

Sap Plant Connectivity

References · 6

• https://bdu.fstec.ru/vul/2023-04035 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-2827 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://t.me/cvenotify/53042 · Telegram Post
• https://t.me/true_secator/4505 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3301942 · Note