Vulnerability · Published Jun 13, 2023 · Assigned by sap

CVE-2023-32114Denial of Service in SAP NetWeaver

Low 2.7

In plain English

A low-severity incorrect permission assignment in SAP NetWeaver (Change and Transport System) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.6%top 51.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP NetWeaver (Change and Transport System)	702731740750751752753754

Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

In plain English

Official description

Affected products (as reported)

References