Vulnerability · Published Mar 14, 2023 · Assigned by sap
CVE-2023-24526Improper Access Control in SAP NetWeaver AS Java (Classload Service)
Medium 5.3
In plain English
A medium-severity missing authentication in NetWeaver AS Java for Classload Service from SAP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 52.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user identity, resulting in escalation of privileges. This failure has a low impact on confidentiality of the data such that an unassigned user can read non-sensitive server data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP | NetWeaver AS Java for Classload Service | 7.50 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N