CVE-2023-25618mediumCWE-400

CVE-2023-25618: medium-severity vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Denial of Service (DoS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Published · Updated

Follow this CVE+ Monitor ABAP Platform+ Monitor SAP NetWeaver AS for ABAP

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.6%
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in an unused class for error handling in which an attacker authenticated as a non-administrative user can craft a request with certain parameters which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
SAP · NetWeaver AS for ABAP and ABAP Platform
Related CVEs — SAP NetWeaver AS for ABAP and ABAP Platform

In the same product, most dangerous first.

CVE-2023-27501HIGHDirectory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform EPSS 1.0%CVE-2023-28763MEDIUMDenial of Service in SAP NetWeaver AS for ABAP and ABAP PlatformEPSS 0.6%CVE-2023-23859MEDIUMCVE-2023-23859EPSS 0.4%CVE-2023-26459HIGHServer Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS for ABAP and ABAP PlatformEPSS 0.4%CVE-2023-0013MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP PlatformEPSS 0.4%CVE-2023-23860MEDIUMCVE-2023-23860EPSS 0.4%