CVE-2023-35874
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
SAP NetWeaver Application Server ABAP and ABAP Platform in versions KRNL64NUC, 7.22 and KERNEL 7.22-7.93 perform improper authentication checks for functionalities requiring user identity. As a result, an attacker can perform malicious actions over the network.
Risk Assessment
This vulnerability may lead to a limited impact on the confidentiality, integrity, and availability of data within the organization. An attacker could exploit this flaw to carry out unauthorized actions.
Recommendation
It is recommended to update to the latest version of SAP NetWeaver Application Server ABAP and ABAP Platform to mitigate this vulnerability. A security audit should also be conducted to identify potential threats.
Other vulnerabilities in SAP NetWeaver Application Server ABAP, ABAP Platform
See all- CVE-2026-23687High
SAP NetWeaver Application Server ABAP and ABAP Platform allow an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may lead to acceptance of tampered identity information and unauthorized access to sensitive user data.
- CVE-2023-37492Medium
SAP NetWeaver Application Server ABAP and ABAP Platform in versions from 700 to 804 do not perform necessary authorization checks for an authenticated user, resulting in privilege escalation. This could allow an attacker to access sensitive information that can be used in a subsequent serious attack.
Original NVD description (English source)
SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, performs improper authentication checks for functionalities that require user identity. An attacker can perform malicious actions over the network, extending the scope of impact, causing a limited impact on confidentiality, integrity and availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS