CVE-2023-41367 - Missing Authentication check in SAP NetWeaver (Guided Procedures)

Back Back to CVE browser

MEDIUM

Missing Authentication check in SAP NetWeaver (Guided Procedures)

Published Sep 12, 2023

5.3

MEDIUM

CVSS 3.1

EPSS 0.55%

Description

Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admin view of specific function anonymously. On successful exploitation of vulnerability under specific circumstances, attacker can view user’s email address. There is no integrity/availability impact.

Affected products

Vendor SAP SE Product SAP NetWeaver (Guided Procedures) Default
unaffected
- Version
  7.50
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP NetWeaver (Guided Procedures)

unaffected

Version	Status	Constraints
7.50	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-45870
Advisory
https://me.sap.com/notes/3348142
Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-45870		Advisory
https://me.sap.com/notes/3348142		Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html		Vendor Advisory