PT-2023-8732 · Sap · Sap Netweaver As Java

Published 2023-05-08 · Updated 2023-05-15 · CVE-2023-30744

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions SAP AS NetWeaver JAVA versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50

Description The issue is related to the lack of authentication for a critical function in SAP AS NetWeaver JAVA, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API. This can enable the attacker to instantiate an object with methods that can be called without further authorization and authentication, potentially reading or changing the state of existing services without affecting availability.

Recommendations For SAP AS NetWeaver JAVA versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, consider restricting access to the open interface and the open naming and directory API to minimize the risk of exploitation. As a temporary workaround, consider disabling the vulnerable methods until a patch is available. Restrict access to the vulnerable object instantiation to prevent unauthorized changes to the state of existing services. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2024-01764

CVE-2023-30744

Affected Products

Sap Netweaver As Java

References · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30744 · Security Note
• https://bdu.fstec.ru/vul/2024-01764 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30744 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3317453 · Note
• https://t.me/cvenotify/50469 · Telegram Post