Skip to content
OpenAdvisories
High WID-SEC-2023-2882 5 CVEs

SAP Software: Mehrere Schwachstellen

Published Nov 13, 2023 · Updated Nov 13, 2023 · de-DE

Vendor: SAP Product: Software Platform: Linux Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in der SAP-Software ausnutzen, um Dateien zu manipulieren, seine Rechte zu erweitern oder vertrauliche Informationen offenzulegen.

Product

SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.

Vulnerabilities 5

  • Critical 9.8
    CVE-2023-40309

    Missing Authorization check in SAP CommonCryptoLib

    SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired…

    SAP SAP Web Dispatcher SAP Host Agent SAP HANA database
  • Critical 9.6
    CVE-2023-31403

    Improper Access Control vulnerability in SAP Business One product installation

    SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious user can read and write to the SMB shared folder. Additionally, the files in the folder can be exec…

    SAP SAP Business One
  • Medium 6.5
    CVE-2023-42477

    Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application)

    SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application.

    SAP SAP NetWeaver AS Java
  • Medium 5.3
    CVE-2023-41366

    Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

    Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KER…

    SAP SAP NetWeaver Application Server ABAP and ABAP Platform
  • Medium 5.3
    CVE-2023-42480

    Information Disclosure in NetWeaver AS Java Logon

    The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availabil…

    SAP NetWeaver AS Java

Revision history

  1. #1

    Initiale Fassung

References