CVE Vulnerability

CVE-2023-0014

SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates information about system identity in an ambiguous format. This could lead to capture-replay vulnerability and may be exploited by malicious users to obtain illegitimate access to the system.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://launchpad.support.sap.com/#/notes/3089413 Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:757:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap_kernel:7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap_kernel:7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap_kernel:7.77:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap_kernel:7.81:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap_kernel:7.85:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap_kernel:7.89:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap_krnl64nuc:7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap_krnl64nuc:7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap_krnl64uc:7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap_krnl64uc:7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap_krnl64uc:7.53:*:*:*:*:*:*:*
Information

Published : 2023-01-10 04:15

Updated : 2023-02-09 03:15

NVD link : CVE-2023-0014

Mitre link : CVE-2023-0014

Products Affected

Sap

CWE
CWE-294

Authentication Bypass by Capture-replay