CVE-2023-41366CWE-497

Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

Medium · published November 14, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
47.3
In the wild
Unconfirmed
What it is

Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT, allows an unauthenticated attacker to access the unintended data due to the lack of restrictions applied which may lead to low impact in confidentiality and no impact on the integrity and availability of the application.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00586 · 47.3th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2023-11-14T01:01Z
EPSS history
Timeline
  • 14 NOV 01:01Z
    Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
    cvelistv5