Action not permitted
Modal body text goes here.
Modal Title
Modal Body
wid-sec-w-2023-0904
Vulnerability from csaf_certbund
Published
2023-04-10 22:00
Modified
2023-04-10 22:00
Summary
SAP Patchday April 2023
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Angriff
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.
Betroffene Betriebssysteme
- UNIX
- Linux
- Windows
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "SAP stellt unternehmensweite L\u00f6sungen f\u00fcr Gesch\u00e4ftsprozesse wie Buchf\u00fchrung, Vertrieb, Einkauf und Lagerhaltung zur Verf\u00fcgung.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0904 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0904.json" }, { "category": "self", "summary": "WID-SEC-2023-0904 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0904" }, { "category": "external", "summary": "SAP Security Patch Day April 2023 vom 2023-04-10", "url": "https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a\u0026rc=10" } ], "source_lang": "en-US", "title": "SAP Patchday April 2023", "tracking": { "current_release_date": "2023-04-10T22:00:00.000+00:00", "generator": { "date": "2024-08-15T17:48:24.376+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-0904", "initial_release_date": "2023-04-10T22:00:00.000+00:00", "revision_history": [ { "date": "2023-04-10T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "SAP Software", "product": { "name": "SAP Software", "product_id": "T016476", "product_identification_helper": { "cpe": "cpe:/a:sap:sap:-" } } } ], "category": "vendor", "name": "SAP" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-29189", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-29189" }, { "cve": "CVE-2023-29187", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-29187" }, { "cve": "CVE-2023-29186", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-29186" }, { "cve": "CVE-2023-29185", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-29185" }, { "cve": "CVE-2023-29112", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-29112" }, { "cve": "CVE-2023-29111", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-29111" }, { "cve": "CVE-2023-29110", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-29110" }, { "cve": "CVE-2023-29109", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-29109" }, { "cve": "CVE-2023-29108", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-29108" }, { "cve": "CVE-2023-28765", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-28765" }, { "cve": "CVE-2023-28763", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-28763" }, { "cve": "CVE-2023-28761", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-28761" }, { "cve": "CVE-2023-27897", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-27897" }, { "cve": "CVE-2023-27499", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-27499" }, { "cve": "CVE-2023-27497", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-27497" }, { "cve": "CVE-2023-27269", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-27269" }, { "cve": "CVE-2023-27267", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-27267" }, { "cve": "CVE-2023-26458", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-26458" }, { "cve": "CVE-2023-24528", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-24528" }, { "cve": "CVE-2023-24527", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-24527" }, { "cve": "CVE-2023-1903", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2023-1903" }, { "cve": "CVE-2022-41272", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2022-41272" }, { "cve": "CVE-2021-33683", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2021-33683" }, { "cve": "CVE-2020-13936", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in SAP Software. Die Fehler bestehen in den Produkten Diagnostics Agent, Business Client, NetWeaver, BusinessObjects Business Intelligence Platform, NetWeaver Application Server for ABAP and ABAP Platform, Landscape Management, SapSetup, Fiori apps 1.0 for travel management in SAP ERP, NetWeaver AS for ABAP and ABAP Platform, GUI for HTML, CRM, Web Dispatcher and Internet Communication Manager, NetWeaver AS Java for Deploy Service, ABAP Platform and SAP Web Dispatcher, Commerce, Application Interface Framework sowie HCM Fiori App My Forms. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Rechte." } ], "product_status": { "known_affected": [ "T016476" ] }, "release_date": "2023-04-10T22:00:00.000+00:00", "title": "CVE-2020-13936" } ] }
cve-2023-27499
Vulnerability from cvelistv5
Published
2023-04-11 02:48
Modified
2025-02-07 19:32
Severity ?
EPSS score ?
Summary
SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user's browser. The information from the victim's web browser can either be modified or read and sent to the attacker.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP_SE | GUI for HTML |
Version: KERNEL 7.22 Version: KERNEL 7.53 Version: KERNEL 7.54 Version: KERNEL 7.77 Version: KERNEL 7.81 Version: KERNEL 7.85 Version: KERNEL 7.89 Version: KERNEL 7.91 Version: KRNL64UC 7.22 Version: KRNL64UC 7.22EXT Version: KRNL64UC 7.53 Version: KRNL64NUC 7.22 Version: KRNL64NUC 7.22EXT |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T12:16:35.477Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3275458" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-27499", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T19:31:59.613500Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T19:32:04.550Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "GUI for HTML", "vendor": "SAP_SE", "versions": [ { "status": "affected", "version": "KERNEL 7.22" }, { "status": "affected", "version": "KERNEL 7.53" }, { "status": "affected", "version": "KERNEL 7.54" }, { "status": "affected", "version": "KERNEL 7.77" }, { "status": "affected", "version": "KERNEL 7.81" }, { "status": "affected", "version": "KERNEL 7.85" }, { "status": "affected", "version": "KERNEL 7.89" }, { "status": "affected", "version": "KERNEL 7.91" }, { "status": "affected", "version": "KRNL64UC 7.22" }, { "status": "affected", "version": "KRNL64UC 7.22EXT" }, { "status": "affected", "version": "KRNL64UC 7.53" }, { "status": "affected", "version": "KRNL64NUC 7.22" }, { "status": "affected", "version": "KRNL64NUC 7.22EXT" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eSAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user\u0027s browser. The information from the victim\u0027s web browser can either be modified or read and sent to the attacker.\u003c/p\u003e" } ], "value": "SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user\u0027s browser. The information from the victim\u0027s web browser can either be modified or read and sent to the attacker.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-05-03T03:20:34.384Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3275458" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-27499", "datePublished": "2023-04-11T02:48:52.677Z", "dateReserved": "2023-03-02T03:37:32.233Z", "dateUpdated": "2025-02-07T19:32:04.550Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-29109
Vulnerability from cvelistv5
Published
2023-04-11 02:58
Modified
2025-02-07 16:52
Severity ?
EPSS score ?
Summary
The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | Application Interface Framework (Message Dashboard) |
Version: AIF 703 Version: AIFX 702 Version: S4CORE 101 Version: SAP_BASIS 755 Version: SAP_BASIS 756 Version: SAP_ABA 75C Version: SAP_ABA 75D Version: SAP_ABA 75E |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T14:00:15.862Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3115598" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-29109", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T16:52:01.499322Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T16:52:14.949Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Application Interface Framework (Message Dashboard)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "AIF 703" }, { "status": "affected", "version": "AIFX 702" }, { "status": "affected", "version": "S4CORE 101" }, { "status": "affected", "version": "SAP_BASIS 755" }, { "status": "affected", "version": "SAP_BASIS 756" }, { "status": "affected", "version": "SAP_ABA 75C" }, { "status": "affected", "version": "SAP_ABA 75D" }, { "status": "affected", "version": "SAP_ABA 75E" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eThe SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application.\u003c/p\u003e" } ], "value": "The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-1236", "description": "CWE-1236: Improper Neutralization of Formula Elements in a CSV File", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:17:39.130Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3115598" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-29109", "datePublished": "2023-04-11T02:58:49.648Z", "dateReserved": "2023-03-31T10:01:53.360Z", "dateUpdated": "2025-02-07T16:52:14.949Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-27267
Vulnerability from cvelistv5
Published
2023-04-11 02:36
Modified
2025-02-07 19:32
Severity ?
EPSS score ?
Summary
Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | Diagnostics Agent (OSCommand Bridge) |
Version: 720 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T12:09:42.300Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3305369" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-27267", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T19:32:40.839354Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T19:32:45.187Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Diagnostics Agent (OSCommand Bridge)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "720" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eDue to missing authentication and\u00a0insufficient input validation,\u00a0the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.\u003c/p\u003e" } ], "value": "Due to missing authentication and\u00a0insufficient input validation,\u00a0the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:25:41.582Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3305369" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge)", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-27267", "datePublished": "2023-04-11T02:36:15.882Z", "dateReserved": "2023-02-27T15:19:34.023Z", "dateUpdated": "2025-02-07T19:32:45.187Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-29189
Vulnerability from cvelistv5
Published
2023-04-11 03:11
Modified
2025-02-07 19:31
Severity ?
EPSS score ?
Summary
SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | CRM (WebClient UI) |
Version: S4FND 102 Version: S4FND 103 Version: S4FND 104 Version: S4FND 105 Version: S4FND 106 Version: S4FND 107 Version: WEBCUIF 700 Version: WEBCUIF 701 Version: WEBCUIF 731 Version: WEBCUIF 730 Version: WEBCUIF 746 Version: WEBCUIF 747 Version: WEBCUIF 748 Version: WEBCUIF 800 Version: WEBCUIF 801 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T14:00:15.877Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3269352" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-29189", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T19:31:40.763545Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T19:31:46.088Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "CRM (WebClient UI)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "S4FND 102" }, { "status": "affected", "version": "S4FND 103" }, { "status": "affected", "version": "S4FND 104" }, { "status": "affected", "version": "S4FND 105" }, { "status": "affected", "version": "S4FND 106" }, { "status": "affected", "version": "S4FND 107" }, { "status": "affected", "version": "WEBCUIF 700" }, { "status": "affected", "version": "WEBCUIF 701" }, { "status": "affected", "version": "WEBCUIF 731" }, { "status": "affected", "version": "WEBCUIF 730" }, { "status": "affected", "version": "WEBCUIF 746" }, { "status": "affected", "version": "WEBCUIF 747" }, { "status": "affected", "version": "WEBCUIF 748" }, { "status": "affected", "version": "WEBCUIF 800" }, { "status": "affected", "version": "WEBCUIF 801" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eSAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields\u003c/p\u003e" } ], "value": "SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-23", "description": "CWE-23: Relative Path Traversal", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:16:30.045Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3269352" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-29189", "datePublished": "2023-04-11T03:11:30.554Z", "dateReserved": "2023-04-03T09:22:43.158Z", "dateUpdated": "2025-02-07T19:31:46.088Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-27897
Vulnerability from cvelistv5
Published
2023-04-11 02:50
Modified
2025-02-07 16:54
Severity ?
EPSS score ?
Summary
In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can can have limited impact on confidentiality and integrity of non-critical user or application data and application availability.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T12:23:30.151Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3309056" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-27897", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T16:54:44.490490Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T16:54:50.000Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "CRM", "vendor": "SAP", "versions": [ { "status": "affected", "version": "700" }, { "status": "affected", "version": "701" }, { "status": "affected", "version": "702" }, { "status": "affected", "version": "712" }, { "status": "affected", "version": "713" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eIn SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can can have limited impact on confidentiality and integrity of non-critical user or application data and application availability.\u003c/p\u003e" } ], "value": "In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can can have limited impact on confidentiality and integrity of non-critical user or application data and application availability.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:19:16.988Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3309056" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Code Injection vulnerability in SAP CRM", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-27897", "datePublished": "2023-04-11T02:50:00.642Z", "dateReserved": "2023-03-07T07:53:14.887Z", "dateUpdated": "2025-02-07T16:54:50.000Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-1903
Vulnerability from cvelistv5
Published
2023-04-11 02:31
Modified
2025-02-07 19:33
Severity ?
EPSS score ?
Summary
SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header data.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | HCM Fiori App My Forms (Fiori 2.0) |
Version: 605 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T06:05:27.060Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3301457" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-1903", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T19:33:21.716814Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T19:33:25.912Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "HCM Fiori App My Forms (Fiori 2.0)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "605" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eSAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header data.\u003c/p\u003e" } ], "value": "SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header data.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-18T14:51:19.551Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3301457" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0)", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-1903", "datePublished": "2023-04-11T02:31:13.493Z", "dateReserved": "2023-04-06T05:17:57.486Z", "dateUpdated": "2025-02-07T19:33:25.912Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-29185
Vulnerability from cvelistv5
Published
2023-04-11 03:08
Modified
2025-02-07 17:12
Severity ?
EPSS score ?
Summary
SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters in certain circumstances which can consume the server's resources sufficiently to make it unavailable over the network without any user interaction.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | NetWeaver AS for ABAP (Business Server Pages) |
Version: 700 Version: 701 Version: 702 Version: 731 Version: 740 Version: 750 Version: 751 Version: 752 Version: 753 Version: 754 Version: 755 Version: 756 Version: 757 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T14:00:15.869Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3303060" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-29185", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T17:12:25.143854Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T17:12:28.598Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "NetWeaver AS for ABAP (Business Server Pages)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "700" }, { "status": "affected", "version": "701" }, { "status": "affected", "version": "702" }, { "status": "affected", "version": "731" }, { "status": "affected", "version": "740" }, { "status": "affected", "version": "750" }, { "status": "affected", "version": "751" }, { "status": "affected", "version": "752" }, { "status": "affected", "version": "753" }, { "status": "affected", "version": "754" }, { "status": "affected", "version": "755" }, { "status": "affected", "version": "756" }, { "status": "affected", "version": "757" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eSAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters in certain circumstances which can consume the server\u0027s resources sufficiently to make it unavailable over the network without any user interaction.\u003c/p\u003e" } ], "value": "SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters in certain circumstances which can consume the server\u0027s resources sufficiently to make it unavailable over the network without any user interaction.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:17:17.240Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3303060" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages)", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-29185", "datePublished": "2023-04-11T03:08:03.125Z", "dateReserved": "2023-04-03T09:22:43.157Z", "dateUpdated": "2025-02-07T17:12:28.598Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-29110
Vulnerability from cvelistv5
Published
2023-04-11 03:00
Modified
2025-02-07 17:13
Severity ?
EPSS score ?
Summary
The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker can inject images from the foreign domains. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | Application Interface Framework (Message Dashboard) |
Version: AIF 703 Version: AIFX 702 Version: S4CORE 100 Version: S4CORE 101 Version: SAP_BASIS 755 Version: SAP_BASIS 756 Version: SAP_ABA 75C Version: SAP_ABA 75D Version: SAP_ABA 75E |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T14:00:15.878Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3113349" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-29110", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T17:13:12.939238Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T17:13:23.603Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Application Interface Framework (Message Dashboard)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "AIF 703" }, { "status": "affected", "version": "AIFX 702" }, { "status": "affected", "version": "S4CORE 100" }, { "status": "affected", "version": "S4CORE 101" }, { "status": "affected", "version": "SAP_BASIS 755" }, { "status": "affected", "version": "SAP_BASIS 756" }, { "status": "affected", "version": "SAP_ABA 75C" }, { "status": "affected", "version": "SAP_ABA 75D" }, { "status": "affected", "version": "SAP_ABA 75E" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eThe SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker can inject images from the foreign domains. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.\u003c/p\u003e" } ], "value": "The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker can inject images from the foreign domains. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:17:48.094Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3113349" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-29110", "datePublished": "2023-04-11T03:00:17.210Z", "dateReserved": "2023-03-31T10:01:53.360Z", "dateUpdated": "2025-02-07T17:13:23.603Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-27269
Vulnerability from cvelistv5
Published
2023-03-14 04:58
Modified
2024-08-02 12:09
Severity ?
EPSS score ?
Summary
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files. In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | NetWeaver Application Server for ABAP and ABAP Platform |
Version: 700 Version: 701 Version: 702 Version: 731 Version: 740 Version: 750 Version: 751 Version: 752 Version: 753 Version: 754 Version: 755 Version: 756 Version: 757 Version: 791 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T12:09:41.843Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3294595" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "NetWeaver Application Server for ABAP and ABAP Platform", "vendor": "SAP", "versions": [ { "status": "affected", "version": "700" }, { "status": "affected", "version": "701" }, { "status": "affected", "version": "702" }, { "status": "affected", "version": "731" }, { "status": "affected", "version": "740" }, { "status": "affected", "version": "750" }, { "status": "affected", "version": "751" }, { "status": "affected", "version": "752" }, { "status": "affected", "version": "753" }, { "status": "affected", "version": "754" }, { "status": "affected", "version": "755" }, { "status": "affected", "version": "756" }, { "status": "affected", "version": "757" }, { "status": "affected", "version": "791" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eSAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files. \u00a0In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.\u003c/p\u003e" } ], "value": "SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files. \u00a0In this attack, no data can be read but potentially critical OS files can be overwritten making the system unavailable.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:24:27.214Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3294595" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-27269", "datePublished": "2023-03-14T04:58:10.184Z", "dateReserved": "2023-02-27T15:19:34.024Z", "dateUpdated": "2024-08-02T12:09:41.843Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-28763
Vulnerability from cvelistv5
Published
2023-04-11 02:52
Modified
2025-02-07 16:54
Severity ?
EPSS score ?
Summary
SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters which can consume the server's resources sufficiently to make it unavailable over the network without any user interaction.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | NetWeaver AS for ABAP and ABAP Platform |
Version: 740 Version: 750 Version: 751 Version: 752 Version: 753 Version: 754 Version: 755 Version: 756 Version: 757 Version: 791 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T13:51:38.228Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3296378" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-28763", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T16:54:10.286221Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T16:54:13.312Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "NetWeaver AS for ABAP and ABAP Platform", "vendor": "SAP", "versions": [ { "status": "affected", "version": "740" }, { "status": "affected", "version": "750" }, { "status": "affected", "version": "751" }, { "status": "affected", "version": "752" }, { "status": "affected", "version": "753" }, { "status": "affected", "version": "754" }, { "status": "affected", "version": "755" }, { "status": "affected", "version": "756" }, { "status": "affected", "version": "757" }, { "status": "affected", "version": "791" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eSAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters which can consume the server\u0027s resources sufficiently to make it unavailable over the network without any user interaction.\u003c/p\u003e" } ], "value": "SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters which can consume the server\u0027s resources sufficiently to make it unavailable over the network without any user interaction.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:18:52.577Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3296378" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-28763", "datePublished": "2023-04-11T02:52:07.602Z", "dateReserved": "2023-03-23T04:20:27.699Z", "dateUpdated": "2025-02-07T16:54:13.312Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-24527
Vulnerability from cvelistv5
Published
2023-04-11 02:33
Modified
2025-02-07 19:33
Severity ?
EPSS score ?
Summary
SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability and integrity.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | NetWeaver AS Java for Deploy Service |
Version: 7.50 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T10:56:04.429Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3287784" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-24527", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T19:33:47.097823Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T19:33:50.934Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "NetWeaver AS Java for Deploy Service", "vendor": "SAP", "versions": [ { "status": "affected", "version": "7.50" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eSAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability and integrity.\u003c/p\u003e" } ], "value": "SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability and integrity.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T21:25:19.634Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3287784" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Improper Access Control in SAP NetWeaver AS Java for Deploy Service", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-24527", "datePublished": "2023-04-11T02:33:38.624Z", "dateReserved": "2023-01-25T15:46:55.581Z", "dateUpdated": "2025-02-07T19:33:50.934Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-29187
Vulnerability from cvelistv5
Published
2023-04-11 03:09
Modified
2025-02-12 19:22
Severity ?
EPSS score ?
Summary
A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depends on various preconditions beyond the attackers control.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | SapSetup (Software Installation Program) |
Version: 9.0 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T14:00:15.993Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3311624" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-29187", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-02-12T19:22:43.431196Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-12T19:22:58.719Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "SapSetup (Software Installation Program)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "9.0" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eA Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depends on various preconditions beyond the attackers control.\u003c/p\u003e" } ], "value": "A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depends on various preconditions beyond the attackers control.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T03:09:31.468Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3311624" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "DLL Hijacking vulnerability in SapSetup (Software Installation Program)", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-29187", "datePublished": "2023-04-11T03:09:31.468Z", "dateReserved": "2023-04-03T09:22:43.158Z", "dateUpdated": "2025-02-12T19:22:58.719Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2022-41272
Vulnerability from cvelistv5
Published
2022-12-13 03:05
Modified
2024-08-03 12:42
Severity ?
EPSS score ?
Summary
An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Integration (PI) - version 7.50 and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data across the entire system. This allows the attacker to have full read access to user data, make limited modifications to user data, and degrade the performance of the system, leading to a high impact on confidentiality and a limited impact on the availability and integrity of the application.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | NetWeaver Process Integration |
Version: 7.50 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T12:42:43.986Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3273480" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "NetWeaver Process Integration", "vendor": "SAP", "versions": [ { "status": "affected", "version": "7.50" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cspan style=\"background-color: white;\"\u003eAn unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Integration (PI) - version 7.50 and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data across the entire system. This allows the attacker to have full read access to user data, make limited modifications to user data, and degrade the performance of the system, leading to a high impact on confidentiality and a limited impact on the availability and integrity of the application.\u003c/span\u003e\u003cbr\u003e" } ], "value": "An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Integration (PI) - version 7.50 and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data across the entire system. This allows the attacker to have full read access to user data, make limited modifications to user data, and degrade the performance of the system, leading to a high impact on confidentiality and a limited impact on the availability and integrity of the application.\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-12-13T03:05:13.650Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3273480" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2022-41272", "datePublished": "2022-12-13T03:05:13.650Z", "dateReserved": "2022-09-21T16:20:14.951Z", "dateUpdated": "2024-08-03T12:42:43.986Z", "requesterUserId": "048f1e0a-8756-40de-bd1f-51292c7183c7", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-27497
Vulnerability from cvelistv5
Published
2023-04-11 02:37
Modified
2025-02-07 19:32
Severity ?
EPSS score ?
Summary
Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | Diagnostics Agent (EventLogServiceCollector) |
Version: 720 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T12:16:35.432Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3305369" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-27497", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T19:32:21.235656Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T19:32:25.313Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Diagnostics Agent (EventLogServiceCollector)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "720" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eDue to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.\u003c/p\u003e" } ], "value": "Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:23:46.198Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3305369" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector)", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-27497", "datePublished": "2023-04-11T02:37:07.584Z", "dateReserved": "2023-03-02T03:37:32.233Z", "dateUpdated": "2025-02-07T19:32:25.313Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-28765
Vulnerability from cvelistv5
Published
2023-04-11 02:53
Modified
2025-02-07 16:53
Severity ?
EPSS score ?
Summary
An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | BusinessObjects Business Intelligence Platform (Promotion Management) |
Version: 420 Version: 430 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T13:51:37.306Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3298961" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-28765", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T16:53:50.456753Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T16:53:55.407Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "BusinessObjects Business Intelligence Platform (Promotion Management)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "420" }, { "status": "affected", "version": "430" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eAn attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user\u2019s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.\u003c/p\u003e" } ], "value": "An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user\u2019s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:19:05.274Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3298961" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-28765", "datePublished": "2023-04-11T02:53:14.910Z", "dateReserved": "2023-03-23T04:20:27.699Z", "dateUpdated": "2025-02-07T16:53:55.407Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-29112
Vulnerability from cvelistv5
Published
2023-04-11 03:03
Modified
2025-02-07 17:12
Severity ?
EPSS score ?
Summary
The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | Application Interface Framework (Message Monitoring) |
Version: 600 Version: 700 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T14:00:15.216Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3114489" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-29112", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T17:12:42.730947Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T17:12:46.693Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Application Interface Framework (Message Monitoring)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "600" }, { "status": "affected", "version": "700" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eThe SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.\u003c/p\u003e" } ], "value": "The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:18:03.202Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3114489" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring)", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-29112", "datePublished": "2023-04-11T03:03:09.047Z", "dateReserved": "2023-03-31T10:01:53.360Z", "dateUpdated": "2025-02-07T17:12:46.693Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2021-33683
Vulnerability from cvelistv5
Published
2021-07-14 11:04
Modified
2024-08-03 23:58
Severity ?
EPSS score ?
Summary
SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc.
References
▼ | URL | Tags |
---|---|---|
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 | x_refsource_MISC | |
https://launchpad.support.sap.com/#/notes/3000663 | x_refsource_MISC |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP SE | SAP Web Dispatcher and Internet Communication Manager |
Version: < KRNL32NUC 7.21 Version: < 7.21EXT Version: < 7.22 Version: < 7.22EXT Version: < KRNL32UC 7.21 Version: < KRNL64NUC 7.21 Version: < 7.49 Version: < KRNL64UC 7.21 Version: < 7.53 Version: < 7.73 Version: < WEBDISP 7.53 Version: < 7.77 Version: < 7.81 Version: < 7.82 Version: < 7.83 Version: < KERNEL 7.21 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T23:58:22.780Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3000663" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "SAP Web Dispatcher and Internet Communication Manager", "vendor": "SAP SE", "versions": [ { "status": "affected", "version": "\u003c KRNL32NUC 7.21" }, { "status": "affected", "version": "\u003c 7.21EXT" }, { "status": "affected", "version": "\u003c 7.22" }, { "status": "affected", "version": "\u003c 7.22EXT" }, { "status": "affected", "version": "\u003c KRNL32UC 7.21" }, { "status": "affected", "version": "\u003c KRNL64NUC 7.21" }, { "status": "affected", "version": "\u003c 7.49" }, { "status": "affected", "version": "\u003c KRNL64UC 7.21" }, { "status": "affected", "version": "\u003c 7.53" }, { "status": "affected", "version": "\u003c 7.73" }, { "status": "affected", "version": "\u003c WEBDISP 7.53" }, { "status": "affected", "version": "\u003c 7.77" }, { "status": "affected", "version": "\u003c 7.81" }, { "status": "affected", "version": "\u003c 7.82" }, { "status": "affected", "version": "\u003c 7.83" }, { "status": "affected", "version": "\u003c KERNEL 7.21" } ] } ], "descriptions": [ { "lang": "en", "value": "SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc." } ], "metrics": [ { "cvssV3_0": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-444", "description": "CWE-444 (HTTP Request Smuggling)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2021-07-14T11:04:45", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506" }, { "tags": [ "x_refsource_MISC" ], "url": "https://launchpad.support.sap.com/#/notes/3000663" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cna@sap.com", "ID": "CVE-2021-33683", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "SAP Web Dispatcher and Internet Communication Manager", "version": { "version_data": [ { "version_name": "\u003c", "version_value": "KRNL32NUC 7.21" }, { "version_name": "\u003c", "version_value": "7.21EXT" }, { "version_name": "\u003c", "version_value": "7.22" }, { "version_name": "\u003c", "version_value": "7.22EXT" }, { "version_name": "\u003c", "version_value": "KRNL32UC 7.21" }, { "version_name": "\u003c", "version_value": "7.21EXT" }, { "version_name": "\u003c", "version_value": "7.22" }, { "version_name": "\u003c", "version_value": "7.22EXT" }, { "version_name": "\u003c", "version_value": "KRNL64NUC 7.21" }, { "version_name": "\u003c", "version_value": "7.21EXT" }, { "version_name": "\u003c", "version_value": "7.22" }, { "version_name": "\u003c", "version_value": "7.22EXT" }, { "version_name": "\u003c", "version_value": "7.49" }, { "version_name": "\u003c", "version_value": "KRNL64UC 7.21" }, { "version_name": "\u003c", "version_value": "7.21EXT" }, { "version_name": "\u003c", "version_value": "7.22" }, { "version_name": "\u003c", "version_value": "7.22EXT" }, { "version_name": "\u003c", "version_value": "7.49" }, { "version_name": "\u003c", "version_value": "7.53" }, { "version_name": "\u003c", "version_value": "7.73" }, { "version_name": "\u003c", "version_value": "WEBDISP 7.53" }, { "version_name": "\u003c", "version_value": "7.73" }, { "version_name": "\u003c", "version_value": "7.77" }, { "version_name": "\u003c", "version_value": "7.81" }, { "version_name": "\u003c", "version_value": "7.82" }, { "version_name": "\u003c", "version_value": "7.83" }, { "version_name": "\u003c", "version_value": "KERNEL 7.21" }, { "version_name": "\u003c", "version_value": "7.22" }, { "version_name": "\u003c", "version_value": "7.49" }, { "version_name": "\u003c", "version_value": "7.53" }, { "version_name": "\u003c", "version_value": "7.73" }, { "version_name": "\u003c", "version_value": "7.77" }, { "version_name": "\u003c", "version_value": "7.81" }, { "version_name": "\u003c", "version_value": "7.82" }, { "version_name": "\u003c", "version_value": "7.83" } ] } } ] }, "vendor_name": "SAP SE" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc." } ] }, "impact": { "cvss": { "baseScore": "5.4", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-444 (HTTP Request Smuggling)" } ] } ] }, "references": { "reference_data": [ { "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506", "refsource": "MISC", "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506" }, { "name": "https://launchpad.support.sap.com/#/notes/3000663", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/3000663" } ] } } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2021-33683", "datePublished": "2021-07-14T11:04:45", "dateReserved": "2021-05-28T00:00:00", "dateUpdated": "2024-08-03T23:58:22.780Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-24528
Vulnerability from cvelistv5
Published
2023-02-14 03:18
Modified
2024-08-02 10:56
Severity ?
EPSS score ?
Summary
SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data. This endpoint is normally exposed over the network and successful exploitation can lead to exposure of data like travel documents.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | Fiori apps 1.0 for travel management in SAP ERP (My Travel Requests) |
Version: 600 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T10:56:04.225Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3290901" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Fiori apps 1.0 for travel management in SAP ERP (My Travel Requests)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "600" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eSAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data. This endpoint is normally exposed over the network and successful exploitation can lead to exposure of data like travel documents.\u003c/p\u003e" } ], "value": "SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data. This endpoint is normally exposed over the network and successful exploitation can lead to exposure of data like travel documents.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-862", "description": "CWE-862: Missing Authorization", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T21:25:07.475Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3290901" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-24528", "datePublished": "2023-02-14T03:18:53.948Z", "dateReserved": "2023-01-25T15:46:55.581Z", "dateUpdated": "2024-08-02T10:56:04.225Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-26458
Vulnerability from cvelistv5
Published
2023-04-11 02:34
Modified
2025-02-07 19:33
Severity ?
EPSS score ?
Summary
An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.The disclosed information is for Diagnostics Agent Connection via Java SCS Message Server of an SAP Solution Manager system and can only be accessed by authenticated SAP Landscape Management users, but they can escalate their privileges to the SAP Solution Manager system.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | Landscape Management |
Version: 3.0 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T11:53:52.754Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3312733" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-26458", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T19:33:03.298235Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T19:33:07.425Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Landscape Management", "vendor": "SAP", "versions": [ { "status": "affected", "version": "3.0" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eAn information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.The disclosed information is for Diagnostics Agent Connection via Java SCS Message Server of an SAP Solution Manager system and can only be accessed by authenticated SAP Landscape Management users, but they can escalate their privileges to the SAP Solution Manager system.\u003c/p\u003e" } ], "value": "An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.The disclosed information is for Diagnostics Agent Connection via Java SCS Message Server of an SAP Solution Manager system and can only be accessed by authenticated SAP Landscape Management users, but they can escalate their privileges to the SAP Solution Manager system.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-668", "description": "CWE-668: Exposure of Resource to Wrong Sphere", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:27:39.061Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3312733" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": " Information Disclosure vulnerability in SAP Landscape Management", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-26458", "datePublished": "2023-04-11T02:34:46.842Z", "dateReserved": "2023-02-22T21:38:25.764Z", "dateUpdated": "2025-02-07T19:33:07.425Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-29108
Vulnerability from cvelistv5
Published
2023-04-11 02:56
Modified
2025-02-12 19:24
Severity ?
EPSS score ?
Summary
The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | ABAP Platform and SAP Web Dispatcher |
Version: WEBDISP 7.85 Version: WEBDISP 7.89 Version: KERNEL 7.85 Version: KERNEL 7.89 Version: KERNEL 7.91 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T14:00:15.410Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3315312" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-29108", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-12T19:23:31.987405Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-12T19:24:16.822Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "ABAP Platform and SAP Web Dispatcher", "vendor": "SAP", "versions": [ { "status": "affected", "version": "WEBDISP 7.85" }, { "status": "affected", "version": "WEBDISP 7.89" }, { "status": "affected", "version": "KERNEL 7.85" }, { "status": "affected", "version": "KERNEL 7.89" }, { "status": "affected", "version": "KERNEL 7.91" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eThe IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources.\u003c/p\u003e" } ], "value": "The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-923", "description": "CWE-923: Improper Restriction of Communication Channel to Intended Endpoints", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T02:56:58.666Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3315312" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "IP filter vulnerability in ABAP Platform and SAP Web Dispatcher\t ", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-29108", "datePublished": "2023-04-11T02:56:58.666Z", "dateReserved": "2023-03-31T10:01:53.359Z", "dateUpdated": "2025-02-12T19:24:16.822Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-29186
Vulnerability from cvelistv5
Published
2023-04-11 03:08
Modified
2025-02-07 17:12
Severity ?
EPSS score ?
Summary
In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | NetWeaver (BI CONT ADDON) |
Version: 707 Version: 737 Version: 747 Version: 757 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T14:00:15.983Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3305907" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-29186", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T17:12:06.654012Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T17:12:10.486Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "NetWeaver (BI CONT ADDON)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "707" }, { "status": "affected", "version": "737" }, { "status": "affected", "version": "747" }, { "status": "affected", "version": "757" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eIn SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to\u00a0upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.\u003c/p\u003e" } ], "value": "In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to\u00a0upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:17:30.169Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3305907" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Directory/Path Traversal vulnerability in SAP NetWeaver.", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-29186", "datePublished": "2023-04-11T03:08:49.584Z", "dateReserved": "2023-04-03T09:22:43.157Z", "dateUpdated": "2025-02-07T17:12:10.486Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-29111
Vulnerability from cvelistv5
Published
2023-04-11 03:01
Modified
2025-02-07 17:13
Severity ?
EPSS score ?
Summary
The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a result, an attacker can cause a low impact on the confidentiality of the application.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | Application Interface Framework (ODATA service) |
Version: 755 Version: 756 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T14:00:14.938Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3117978" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-29111", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T17:12:59.700072Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T17:13:03.654Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Application Interface Framework (ODATA service)", "vendor": "SAP", "versions": [ { "status": "affected", "version": "755" }, { "status": "affected", "version": "756" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eThe SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a result, an attacker can cause a low impact on the confidentiality of the application.\u003c/p\u003e" } ], "value": "The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a result, an attacker can cause a low impact on the confidentiality of the application.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:17:55.250Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3117978" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service)", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-29111", "datePublished": "2023-04-11T03:01:14.297Z", "dateReserved": "2023-03-31T10:01:53.360Z", "dateUpdated": "2025-02-07T17:13:03.654Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-28761
Vulnerability from cvelistv5
Published
2023-04-11 02:51
Modified
2025-02-07 16:54
Severity ?
EPSS score ?
Summary
In SAP NetWeaver Enterprise Portal - version 7.50, an unauthenticated attacker can attach to an open interface and make use of an open API to access a service which will enable them to access or modify server settings and data, leading to limited impact on confidentiality and integrity.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
SAP | NetWeaver Enterprise Portal |
Version: 7.50 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T13:51:38.211Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://launchpad.support.sap.com/#/notes/3289994" }, { "tags": [ "x_transferred" ], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-28761", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-02-07T16:54:25.757794Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-07T16:54:28.345Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "NetWeaver Enterprise Portal", "vendor": "SAP", "versions": [ { "status": "affected", "version": "7.50" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cp\u003eIn\u00a0SAP NetWeaver Enterprise Portal - version 7.50,\u00a0an unauthenticated attacker can attach to an open interface and make use of an open API to access a service which will enable them to access or modify server settings and data, leading to limited impact on confidentiality and integrity.\u003c/p\u003e" } ], "value": "In\u00a0SAP NetWeaver Enterprise Portal - version 7.50,\u00a0an unauthenticated attacker can attach to an open interface and make use of an open API to access a service which will enable them to access or modify server settings and data, leading to limited impact on confidentiality and integrity.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function", "lang": "eng", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-11T20:18:43.102Z", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap" }, "references": [ { "url": "https://launchpad.support.sap.com/#/notes/3289994" }, { "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Missing Authentication check in SAP NetWeaver Enterprise Portal", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2023-28761", "datePublished": "2023-04-11T02:51:23.530Z", "dateReserved": "2023-03-23T04:20:27.699Z", "dateUpdated": "2025-02-07T16:54:28.345Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2020-13936
Vulnerability from cvelistv5
Published
2021-03-10 08:00
Modified
2025-02-13 16:27
Severity ?
EPSS score ?
Summary
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Apache Software Foundation | Apache Velocity Engine |
Version: Apache Velocity Engine < |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T12:32:14.319Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E" }, { "name": "[velocity-user] 20210310 CVE-2020-13936: Velocity Sandbox Bypass", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E" }, { "name": "[velocity-commits] 20210310 [velocity-site] 01/01: CVE announcement", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E" }, { "name": "[oss-security] 20210309 CVE-2020-13936: Velocity Sandbox Bypass", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2021/03/10/1" }, { "name": "[announce] 20210310 CVE-2020-13936: Velocity Sandbox Bypass", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6%40%3Cannounce.apache.org%3E" }, { "name": "[druid-commits] 20210316 [GitHub] [druid] clintropolis opened a new pull request #11002: suppress CVE check for security fix", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd%40%3Ccommits.druid.apache.org%3E" }, { "name": "[debian-lts-announce] 20210317 [SECURITY] [DLA 2595-1] velocity security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html" }, { "name": "[ws-dev] 20210318 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210318 [jira] [Created] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210319 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210319 [jira] [Comment Edited] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210322 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c%40%3Cdev.ws.apache.org%3E" }, { "name": "[santuario-dev] 20210323 [GitHub] [santuario-xml-security-java] dependabot[bot] opened a new pull request #33: Bump dependency-check-maven from 6.1.2 to 6.1.3", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4%40%3Cdev.santuario.apache.org%3E" }, { "name": "[ws-dev] 20210324 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210325 [jira] [Updated] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210325 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245%40%3Cdev.ws.apache.org%3E" }, { "name": "[turbine-commits] 20210329 svn commit: r1888167 - /turbine/core/trunk/pom.xml", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7%40%3Ccommits.turbine.apache.org%3E" }, { "name": "[ws-dev] 20210331 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210401 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436%40%3Cdev.ws.apache.org%3E" }, { "name": "GLSA-202107-52", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/202107-52" }, { "name": "[activemq-users] 20210830 Security issues", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E" }, { "name": "[activemq-users] 20210831 RE: Security issues", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Apache Velocity Engine", "vendor": "Apache Software Foundation", "versions": [ { "lessThanOrEqual": "2.2", "status": "affected", "version": "Apache Velocity Engine", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "This issue was discovered by Alvaro Munoz pwntester@github.com of Github Security Labs and was originally reported as GHSL-2020-048." } ], "descriptions": [ { "lang": "en", "value": "An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2." } ], "problemTypes": [ { "descriptions": [ { "description": "Velocity Sandbox Bypass", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2024-08-04T12:34:05.000Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E" }, { "name": "[velocity-user] 20210310 CVE-2020-13936: Velocity Sandbox Bypass", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E" }, { "name": "[velocity-commits] 20210310 [velocity-site] 01/01: CVE announcement", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E" }, { "name": "[oss-security] 20210309 CVE-2020-13936: Velocity Sandbox Bypass", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2021/03/10/1" }, { "name": "[announce] 20210310 CVE-2020-13936: Velocity Sandbox Bypass", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6%40%3Cannounce.apache.org%3E" }, { "name": "[druid-commits] 20210316 [GitHub] [druid] clintropolis opened a new pull request #11002: suppress CVE check for security fix", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd%40%3Ccommits.druid.apache.org%3E" }, { "name": "[debian-lts-announce] 20210317 [SECURITY] [DLA 2595-1] velocity security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html" }, { "name": "[ws-dev] 20210318 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210318 [jira] [Created] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210319 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210319 [jira] [Comment Edited] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210322 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c%40%3Cdev.ws.apache.org%3E" }, { "name": "[santuario-dev] 20210323 [GitHub] [santuario-xml-security-java] dependabot[bot] opened a new pull request #33: Bump dependency-check-maven from 6.1.2 to 6.1.3", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4%40%3Cdev.santuario.apache.org%3E" }, { "name": "[ws-dev] 20210324 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210325 [jira] [Updated] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210325 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245%40%3Cdev.ws.apache.org%3E" }, { "name": "[turbine-commits] 20210329 svn commit: r1888167 - /turbine/core/trunk/pom.xml", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7%40%3Ccommits.turbine.apache.org%3E" }, { "name": "[ws-dev] 20210331 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad%40%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210401 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436%40%3Cdev.ws.apache.org%3E" }, { "name": "GLSA-202107-52", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/202107-52" }, { "name": "[activemq-users] 20210830 Security issues", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E" }, { "name": "[activemq-users] 20210831 RE: Security issues", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "Velocity Sandbox Bypass", "workarounds": [ { "lang": "en", "value": "Applications using Apache Velocity that allow untrusted users to upload templates should upgrade to version 2.3. This version adds additional default restrictions on what methods/properties can be accessed in a template." } ], "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@apache.org", "ID": "CVE-2020-13936", "STATE": "PUBLIC", "TITLE": "Velocity Sandbox Bypass" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Apache Velocity Engine", "version": { "version_data": [ { "version_affected": "\u003c=", "version_name": "Apache Velocity Engine", "version_value": "2.2" } ] } } ] }, "vendor_name": "Apache Software Foundation" } ] } }, "credit": [ { "lang": "eng", "value": "This issue was discovered by Alvaro Munoz pwntester@github.com of Github Security Labs and was originally reported as GHSL-2020-048." } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Velocity Sandbox Bypass" } ] } ] }, "references": { "reference_data": [ { "name": "https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E", "refsource": "MISC", "url": "https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E" }, { "name": "[velocity-user] 20210310 CVE-2020-13936: Velocity Sandbox Bypass", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a@%3Cuser.velocity.apache.org%3E" }, { "name": "[velocity-commits] 20210310 [velocity-site] 01/01: CVE announcement", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6@%3Ccommits.velocity.apache.org%3E" }, { "name": "[oss-security] 20210309 CVE-2020-13936: Velocity Sandbox Bypass", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2021/03/10/1" }, { "name": "[announce] 20210310 CVE-2020-13936: Velocity Sandbox Bypass", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6@%3Cannounce.apache.org%3E" }, { "name": "[druid-commits] 20210316 [GitHub] [druid] clintropolis opened a new pull request #11002: suppress CVE check for security fix", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd@%3Ccommits.druid.apache.org%3E" }, { "name": "[debian-lts-announce] 20210317 [SECURITY] [DLA 2595-1] velocity security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html" }, { "name": "[ws-dev] 20210318 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726@%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210318 [jira] [Created] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340@%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210319 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7@%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210319 [jira] [Comment Edited] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058@%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210322 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c@%3Cdev.ws.apache.org%3E" }, { "name": "[santuario-dev] 20210323 [GitHub] [santuario-xml-security-java] dependabot[bot] opened a new pull request #33: Bump dependency-check-maven from 6.1.2 to 6.1.3", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4@%3Cdev.santuario.apache.org%3E" }, { "name": "[ws-dev] 20210324 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da@%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210325 [jira] [Updated] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9@%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210325 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245@%3Cdev.ws.apache.org%3E" }, { "name": "[turbine-commits] 20210329 svn commit: r1888167 - /turbine/core/trunk/pom.xml", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7@%3Ccommits.turbine.apache.org%3E" }, { "name": "[ws-dev] 20210331 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad@%3Cdev.ws.apache.org%3E" }, { "name": "[ws-dev] 20210401 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436@%3Cdev.ws.apache.org%3E" }, { "name": "GLSA-202107-52", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202107-52" }, { "name": "[activemq-users] 20210830 Security issues", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E" }, { "name": "[activemq-users] 20210831 RE: Security issues", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E" }, { "name": "https://www.oracle.com/security-alerts/cpujan2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "name": "https://www.oracle.com/security-alerts/cpuapr2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" } ] }, "source": { "discovery": "UNKNOWN" }, "work_around": [ { "lang": "en", "value": "Applications using Apache Velocity that allow untrusted users to upload templates should upgrade to version 2.3. This version adds additional default restrictions on what methods/properties can be accessed in a template." } ] } } }, "cveMetadata": { "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2020-13936", "datePublished": "2021-03-10T08:00:19.000Z", "dateReserved": "2020-06-08T00:00:00.000Z", "dateUpdated": "2025-02-13T16:27:29.361Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.