CVE-2023-35874
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
SAP NetWeaver Application Server ABAP and ABAP Platform in versions KRNL64NUC, 7.22 and KERNEL 7.22-7.93 perform improper authentication checks for functionalities requiring user identity. As a result, an attacker can perform malicious actions over the network.
Risk Assessment
This vulnerability may lead to a limited impact on the confidentiality, integrity, and availability of data within the organization. An attacker could exploit this flaw to carry out unauthorized actions.
Recommendation
It is recommended to update to the latest version of SAP NetWeaver Application Server ABAP and ABAP Platform to mitigate this vulnerability. A security audit should also be conducted to identify potential threats.
Original NVD description (English source)
SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, performs improper authentication checks for functionalities that require user identity. An attacker can perform malicious actions over the network, extending the scope of impact, causing a limited impact on confidentiality, integrity and availability.