CVE-2023-37491

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-37491

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

T

he ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable.

References
Link Resource
https://me.sap.com/notes/3344295 Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
https://me.sap.com/notes/3344295 Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:message_server:kernel_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:message_server:kernel_7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:message_server:kernel_7.54:*:*:*:*:*:*:*
cpe:2.3:a:sap:message_server:kernel_7.77:*:*:*:*:*:*:*
cpe:2.3:a:sap:message_server:krnl64nuc_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:message_server:krnl64nuc_7.22ex:*:*:*:*:*:*:*
cpe:2.3:a:sap:message_server:rnl64uc_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:message_server:rnl64uc_7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:message_server:rnl64uc_7.53:*:*:*:*:*:*:*
History

21 Nov 2024, 08:11

Type Values Removed Values Added
References () https://me.sap.com/notes/3344295 - Permissions Required () https://me.sap.com/notes/3344295 - Permissions Required
References () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 7.5

28 Sep 2024, 22:15

Type Values Removed Values Added
Summary (en) The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable. (en) The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable.
CWE CWE-285 CWE-863
Information

Published : 2023-08-08 01:15

Updated : 2024-11-21 08:11

NVD link : CVE-2023-37491

Mitre link : CVE-2023-37491

CVE.ORG link : CVE-2023-37491

JSON object : View

Products Affected

sap

CWE
CWE-863

Incorrect Authorization