PT-2023-5868 · Sap · Sap Netweaver As Java

Published 2023-10-09 · Updated 2023-10-16 · CVE-2023-42477

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java (GRMG Heartbeat application) version 7.50

Description The issue is related to insufficient validation of incoming requests in the Generic Request and Message Generator (GRMG)/Heartbeat service of the SAP NetWeaver AS for Java platform. This can allow a remote attacker to perform a Server-Side Request Forgery (SSRF) attack, potentially causing limited impact on the confidentiality and integrity of the application.

Recommendations For version 7.50, consider implementing additional validation for incoming requests to the GRMG Heartbeat application to prevent SSRF attacks. As a temporary workaround, restrict access to the vulnerable GRMG/Heartbeat service until a patch is available.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2023-06561

CVE-2023-42477

Affected Products

Sap Netweaver As Java

References · 8

• https://osv.dev/vulnerability/CVE-2023-42477 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06561 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-42477 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://t.me/cvenotify/59157 · Telegram Post
• https://help.sap.com/doc/saphelp_nw73ehp1/7.31.19/en-US/48/b3ea25623035b7e10000000a42189d/content.htm · Note
• https://me.sap.com/notes/3333426 · Note
• https://t.me/cibsecurity/71884 · Telegram Post