PT-2023-4140 · Sap · Sap Netweaver Process Integration

Published 2023-07-10 · Updated 2023-07-19 · CVE-2023-35873

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration version SAP XITOOL 7.50

Description The issue is related to the lack of authentication for a critical function in the Runtime Workbench (RWB) component of SAP NetWeaver Process Integration. This could allow a remote attacker to impact the confidentiality and availability of protected information. The vulnerability may enable an unauthenticated user to access technical data about the product status and its configuration, but it does not allow access to sensitive information or administrative functionalities. The exploitation of this issue can cause limited impact on the confidentiality and availability of the application.

Recommendations For version SAP XITOOL 7.50, consider implementing authentication checks for critical functionalities to prevent unauthorized access. As a temporary workaround, restrict access to technical data about the product status and its configuration until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-04449

CVE-2023-35873

Affected Products

Sap Netweaver Process Integration

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04449 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35873 · Security Note
• https://me.sap.com/notes/3343547 · Note