6.5

CVE-2023-37492

Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform

SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 793, SAP_BASIS 804, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read sensitive information which can be used in a subsequent serious attack.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Netweaver Application Server Abap Version 700 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 701 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 702 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 731 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 740 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 750 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 752 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 753 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 754 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 755 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 756 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 757 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 758 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 793 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 804 SwEdition sap_basis
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.48% 0.391
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
SAP 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
Vendor Advisory
https://me.sap.com/notes/3348000
Permissions Required