CVEvulnerability

CVE-2023-35874

7.4 HIGH Published 2023-07-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-07-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.0 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weaknesses
CWE-306

Description

SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, performs improper authentication checks for functionalities that require user identity. An attacker can perform malicious actions over the network, extending the scope of impact, causing a limited impact on confidentiality, integrity and availability.

Affected configurations

• sap netweaver application server abap kernel 7.22 • sap netweaver application server abap kernel 7.53 • sap netweaver application server abap kernel 7.54 • sap netweaver application server abap kernel 7.77 • sap netweaver application server abap kernel 7.81 • sap netweaver application server abap kernel 7.85 • sap netweaver application server abap kernel 7.89 • sap netweaver application server abap kernel 7.92 • sap netweaver application server abap kernel 7.93 • sap netweaver application server abap krnl64nuc 7.22 • sap netweaver application server abap krnl64nuc 7.22ext • sap netweaver application server abap krnl64uc 7.22 • sap netweaver application server abap krnl64uc 7.22ext • sap netweaver application server abap krnl64uc 7.53

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References