PT-2023-4629 · Sap · Sap Netweaver As Java

Published 2023-07-11 · Updated 2023-07-18 · CVE-2023-31405

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS for Java versions 7.50

Description The issue allows an unauthenticated attacker to craft a request over the network, resulting in unwarranted modifications to a system log without user interaction. It is related to incorrect data handling in the log registration journals. There is no ability to view any information or any effect on availability. Exploitation of the issue may allow a remote attacker to access, modify, or delete data by sending a specially crafted request.

Recommendations For SAP NetWeaver AS for Java version 7.50, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-117

Related Identifiers

BDU:2023-05036

CVE-2023-31405

Affected Products

Sap Netweaver As Java

References · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05036 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31405 · Security Note
• https://abex.io/advisory/version/ENGINEAPI%207.50 · Note
• https://me.sap.com/notes/3324732 · Note