CVE-2023-24521

MediumCVSS 6.1

Published: 14/02/2023(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

33th percentile - higher than 33% of all known CVEs

Summary

SAP NetWeaver AS ABAP (BSP Framework) versions 700–757 do not sufficiently sanitize input, allowing an unauthenticated user to alter the current user session by injecting malicious code over the network and gain access to unintended data. This may have a limited impact on confidentiality and integrity.

Risk Assessment

An attacker could hijack or modify a user session and access data they should not reach. This may compromise data confidentiality and integrity in the SAP system.

Recommendation

Apply the SAP fix for SAP NetWeaver AS ABAP (BSP Framework) covering versions 700–757. Monitor for unusual session behavior and deploy code-injection protections.

Other vulnerabilities in SAP NetWeaver AS ABAP

CVE-2025-42902Medium
Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket to the SAP application server. This leads to a dereference of NULL which makes the work process crash. As a result, it has a low impact on the availability but no impact on the confidentiality and integrity.

Original NVD description (English source)

Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS