Vulnerability · Published Apr 11, 2023 · Assigned by sap
CVE-2023-24527Improper Access Control in SAP NetWeaver AS Java for Deploy Service
Medium 5.3
In plain English
A medium-severity missing authentication in NetWeaver AS Java for Deploy Service from SAP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).
Official description
SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability and integrity.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP | NetWeaver AS Java for Deploy Service | 7.50 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N