CVE-2023-2827CWE-306

Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital

High · published June 13, 2023

CVSS v3.1
7.9
EPSS
0%
Percentile
19.9
In the wild
Unconfirmed
What it is

SAP Plant Connectivity - version 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing - version 1.0, do not validate the signature of the JSON Web Token (JWT) in the HTTP request sent from SAP Digital Manufacturing. Therefore, unauthorized callers from the internal network could send service requests to PCo or the Production Connector, which could have an impact on the integrity of the integration with SAP Digital Manufacturing.

The record
Technical detail
CVSS v3.1
7.9 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00285 · 19.9th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2023-06-13T02:36Z
EPSS history
Timeline
  • 13 JUN 02:36Z
    Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital
    cvelistv5