SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability and integrity.
References
| Link | Resource |
|---|---|
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
| https://launchpad.support.sap.com/#/notes/3287784 | Permissions Required |
Configurations
History
14 Apr 2023, 19:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://launchpad.support.sap.com/#/notes/3287784 - Permissions Required | |
| References | (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| First Time |
Sap netweaver As Java For Deploy Service
Sap |
|
| CPE | cpe:2.3:a:sap:netweaver_as_java_for_deploy_service:7.5:*:*:*:*:*:*:* |
11 Apr 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-11 03:15
Updated : 2023-04-14 19:02
NVD link : CVE-2023-24527
Mitre link : CVE-2023-24527
JSON object : View
Products Affected
sap
- netweaver_as_java_for_deploy_service
CWE
CWE-306
Missing Authentication for Critical Function