PT-2023-4071 · Sap · Sap Netweaver Process Integration

Published 2023-07-11 · Updated 2023-07-19 · CVE-2023-35872

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration version SAP XIAF 7.50

Description The issue is related to the Message Display Tool (MDT) component of SAP NetWeaver Process Integration, which lacks proper authentication checks for certain functionalities. This allows an unauthenticated user to access technical data about the product status and its configuration, potentially causing limited impact on confidentiality and availability of the application. However, it does not allow access to sensitive information or administrative functionalities.

Recommendations For SAP NetWeaver Process Integration version SAP XIAF 7.50, consider implementing additional authentication checks for the Message Display Tool (MDT) component to prevent unauthorized access to technical data. As a temporary workaround, restrict access to the MDT component to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-04369

CVE-2023-35872

Affected Products

Sap Netweaver Process Integration

References · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04369 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-35872 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35872 · Vendor Advisory
• https://blogs.sap.com/2023/07/11/sap-security-patch-day-july-2023 · Note
• https://me.sap.com/notes/3343564 · Note