Log in Start free

Vulnerability · Published Aug 8, 2023 · Assigned by sap

CVE-2023-37491Improper Authorization check vulnerability in SAP Message Server

High 7.5

In plain English

A high-severity incorrect authorization in SAP Message Server from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 55.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP Message Server KERNEL 7.22KERNEL 7.53KERNEL 7.54KERNEL 7.77RNL64UC 7.22RNL64UC 7.22EXTRNL64UC 7.53KRNL64NUC 7.22

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References