CVE-2023-33990
Assigner: sap
Published: 2023-07-11T02:29:57.811Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: SAP SQL Anywhere
vendor: SAP_SE
versions: status: affected
version: 17.0
descriptions: supportingMedia: base64: no
type: text/html
value: <p>SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory objects. This can be leveraged by an attacker to perform a Denial of Service. Further, an attacker might be able to modify sensitive data in shared memory objects.This issue only affects SAP SQL Anywhere on Windows. Other platforms are not impacted.</p>
value: SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory objects. This can be leveraged by an attacker to perform a Denial of Service. Further, an attacker might be able to modify sensitive data in shared memory objects.This issue only affects SAP SQL Anywhere on Windows. Other platforms are not impacted.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
type: CWE
source: discovery: UNKNOWN
title: Denial of Service (DoS) vulnerability in SAP SQL Anywhere
x_generator: engine: Vulnogram 0.1.0-dev