Vulnerability · Published Mar 14, 2023 · Assigned by sap
CVE-2023-27268Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service)
Medium 5.3
In plain English
A medium-severity improper access control in NetWeaver AS Java (Object Analyzing Service) from SAP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability., resulting in escalation of privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP | NetWeaver AS Java (Object Analyzing Service) | 7.50 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N