CVE-2023-23857
Assigner: sap
Published: 2023-03-14T04:36:33.138Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: NetWeaver AS for Java
vendor: SAP
versions: status: affected
version: 7.50
descriptions: supportingMedia: base64: no
type: text/html
value: <p>Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and services across systems. On a successful exploitation, the attacker can read and modify some sensitive information but can also be used to lock up any element or operation of the system making that it unresponsive or unavailable.</p>
value: Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and services across systems. On a successful exploitation, the attacker can read and modify some sensitive information but can also be used to lock up any element or operation of the system making that it unresponsive or unavailable.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-287
description: CWE-287: Improper Authentication
type: CWE
source: discovery: UNKNOWN
title: Improper Access Control in SAP NetWeaver AS for Java
x_generator: engine: Vulnogram 0.1.0-dev