Vulnerability · Published Dec 12, 2023 · Assigned by sap
CVE-2023-49581SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
Medium 4.1
In plain English
A medium-severity SQL injection in SAP NetWeaver Application Server ABAP and ABAP Platform from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase response times of the AS ABAP, leading to mild impact on availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | SAP_BASIS 700SAP_BASIS731SAP_BASIS740SAP_BASIS750 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L