CVE-2023-49581 Vulnerability Details

  /     /     /  

CVE-2023-49581 Metadata Quick Info

CVE Published: 12/12/2023 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: sap | Vendor: SAP_SE | Product: SAP NetWeaver Application Server ABAP and ABAP Platform
Status : PUBLISHED

---

CVE-2023-49581 Description

SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase response times of the AS ABAP, leading to mild impact on availability.

Metrics

CVSS Version: 3.1 | Base Score: 4.1 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* HIGH
    Privileges Required (PR)* HIGH
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* LOW
    Integrity Impact (I)* LOW
    Availability Impact (A)* LOW

Weakness Enumeration (CWE)

CWE-ID: CWE-89
CWE Name: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ( SQL Injection )
Source: SAP_SE

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).