PT-2023-4101 · Sap · Sap Netweaver

Published 2023-07-10 · Updated 2023-07-19 · CVE-2023-33989

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver (BI CONT ADD ON) versions 707, 737, 747, 757

Description The issue is related to incorrect restriction of a directory path with limited access in the SAP NetWeaver software integration platform. This can be exploited by a remote attacker to overwrite arbitrary files. An attacker with non-administrative authorizations can exploit a directory traversal flaw to overwrite system files, potentially leading to system compromise. However, data from confidential files cannot be read.

Recommendations For SAP NetWeaver (BI CONT ADD ON) versions 707, 737, 747, 757, consider restricting access to the vulnerable directory traversal functionality until a patch is available. As a temporary workaround, avoid using the vulnerable directory traversal function in the affected SAP NetWeaver versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-04409

CVE-2023-33989

Affected Products

Sap Netweaver

References · 8

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33989 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33989 · Security Note
• https://bdu.fstec.ru/vul/2023-04409 · Security Note
• https://t.me/cvenotify/54642 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023072753 · Note
• https://me.sap.com/notes/3331376 · Note
• https://t.me/cvenotify/54038 · Telegram Post