8.8
CVE-2023-37491
- EPSS 0.04%
- Published 08.08.2023 01:15:18
- Last modified 21.11.2024 08:11:49
- Source cna@sap.com
- Teams watchlist Login
- Open Login
The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable.
Data is provided by the National Vulnerability Database (NVD)
SAP ≫ Message Server Versionkernel_7.22
SAP ≫ Message Server Versionkernel_7.53
SAP ≫ Message Server Versionkernel_7.54
SAP ≫ Message Server Versionkernel_7.77
SAP ≫ Message Server Versionkrnl64nuc_7.22
SAP ≫ Message Server Versionkrnl64nuc_7.22ex
SAP ≫ Message Server Versionrnl64uc_7.22
SAP ≫ Message Server Versionrnl64uc_7.22ext
SAP ≫ Message Server Versionrnl64uc_7.53
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.04% | 0.123 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| cna@sap.com | 7.5 | 1.6 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-863 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.