CVE-2023-0017criticalCWE-284

CVE-2023-0017: fallo crítico en SAP NetWeaver AS for Java

Improper access control in SAP NetWeaver AS for Java

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear SAP NetWeaver AS for JAVA

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.4epss 16%
An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data on the current system. This could allow the attacker to have full read access to user data, make modifications to user data, and make services within the system unavailable.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Productos afectados
SAP · NetWeaver AS for Java
CVEs relacionadas — SAP NetWeaver AS for Java

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-23857CRITICALImproper Access Control in SAP NetWeaver AS for JavaEPSS 0.5%CVE-2023-26460MEDIUMImproper Access Control in SAP NetWeaver AS Java (Cache Management Service)EPSS 0.5%