CVE-2023-35874CWE-306

Improper authentication vulnerability in SAP NetWeaver AS ABAP and ABAP Platform

Medium · published July 11, 2023

CVSS v3.1
6.0
EPSS
0%
Percentile
32.2
In the wild
Unconfirmed
What it is

SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, performs improper authentication checks for functionalities that require user identity. An attacker can perform malicious actions over the network, extending the scope of impact, causing a limited impact on confidentiality, integrity and availability.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00392 · 32.2th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2023-07-11T02:47Z
EPSS history
Timeline
  • 11 JUL 02:47Z
    Improper authentication vulnerability in SAP NetWeaver AS ABAP and ABAP Platform
    cvelistv5