What is CVE-2023-26461?

CVE-2023-26461 is a medium-severity vulnerability in SAP Netweaver Enterprise Portal, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.8/10. Published 2023-03-14.

How severe is CVE-2023-26461?

Medium severity. CVSS v3 base score is 6.8 out of 10.

XXE in SAP Netweaver Enterprise Portal

CVE-2023-26461

SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to access but not modify sensitive files and data. It allows the attacker to view sensitive data which is owned by certain privileges.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.005 (41.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N.

Affected products

Sap Netweaver_enterprise_portal — versions 7.50
Sap Netweaver (Sap Enterprise Portal) — versions 7.50

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

cna@sap.com (Permissions Required)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-26461?: CVE-2023-26461 is a medium-severity vulnerability in SAP Netweaver Enterprise Portal, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.8/10. Published 2023-03-14.
How severe is CVE-2023-26461?: Medium severity. CVSS v3 base score is 6.8 out of 10.