Vulnerability · Published Jul 11, 2023 · Assigned by sap

CVE-2023-35873Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench)

Medium 6.5

In plain English

A medium-severity missing authentication in SAP NetWeaver Process Integration (Runtime Workbench) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 52.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP NetWeaver Process Integration (Runtime Workbench)	SAP_XITOOL 7.50

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

In plain English

Official description

Affected products (as reported)

References