CVE-2023-42480

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-42480
The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability.

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://me.sap.com/notes/3366410 Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*
History

20 Nov 2023, 19:59

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
First Time Sap
Sap netweaver Application Server Java
References () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - () https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory
References () https://me.sap.com/notes/3366410 - () https://me.sap.com/notes/3366410 - Permissions Required
CPE cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*

14 Nov 2023, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-11-14 01:15

Updated : 2023-11-20 19:59

NVD link : CVE-2023-42480

Mitre link : CVE-2023-42480

JSON object : View

Products Affected

sap

  • netweaver_application_server_java
CWE

No CWE.