Vulnerability in SAP Netweaver Abap Server And Platform
CVE-2023-0014
SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates information about system identity in an ambiguous format. This could lead to capture-replay vulnerability and may be exploited by malicious users to obtain illegitimate access to the system.
EPSS: 0.007 (50.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Sap Netweaver Abap Server And Platform — versions SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 710
- Sap Netweaver_application_server_abap — versions 700, 701, 702
- Sap Netweaver_application_server_abap_kernel — versions 7.22, 7.53, 7.77
- Sap Netweaver_application_server_abap_krnl64nuc — versions 7.22, 7.22ext
- Sap Netweaver_application_server_abap_krnl64uc — versions 7.22, 7.22ext, 7.53
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@sap.com (Permissions Required, Vendor Advisory)
- cna@sap.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-0014?
- CVE-2023-0014 is a critical-severity vulnerability in SAP Netweaver Abap Server And Platform, classified under Authentication Bypass by Capture-replay. CVSS score: 9.0/10. Published 2023-01-10.
- How severe is CVE-2023-0014?
- Critical severity. CVSS v3 base score is 9.0 out of 10.
- Is CVE-2023-0014 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.