CVE-2023-0014

high-risk
Published 2023-01-10

SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates information about system identity in an ambiguous format. This could lead to capture-replay vulnerability and may be exploited by malicious users to obtain illegitimate access to the system.

Do I need to act?

-
0.41% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.0/10 Critical
NETWORK / HIGH complexity

Affected Products (20)

Netweaver Application Server Abap Kernel
Netweaver Application Server Abap Kernel
Netweaver Application Server Abap Kernel
Netweaver Application Server Abap Kernel

Affected Vendors

Sap

References (4)

Permissions Required https://launchpad.support.sap.com/#/notes/3089413
Vendor Advisory https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
Permissions Required https://launchpad.support.sap.com/#/notes/3089413
Vendor Advisory https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
50
/ 100
high-risk
Severity 26/34 · High
Exploitability 2/34 · Minimal
Exposure 22/34 · High