CVEvulnerability

CVE-2023-37491

8.8 HIGH Published 2023-08-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-08-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863

Description

The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable.

Affected configurations

• sap message server kernel 7.22 • sap message server kernel 7.53 • sap message server kernel 7.54 • sap message server kernel 7.77 • sap message server krnl64nuc 7.22 • sap message server krnl64nuc 7.22ex • sap message server rnl64uc 7.22 • sap message server rnl64uc 7.22ext • sap message server rnl64uc 7.53

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References