What is CVE-2023-33990?

CVE-2023-33990 is a high-severity vulnerability in Sap Sql_anywhere, classified under Insecure Inherited Permissions. CVSS score: 7.8/10. Published 2023-07-11.

How severe is CVE-2023-33990?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Sap Sql_anywhere

CVE-2023-33990

SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory obj…

EPSS: 0.002 (5.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sap Sql_anywhere — versions 17.0
Sap_se Sap Sql Anywhere — versions 17.0

Weakness classification (CWE)

CWE-277 — Insecure Inherited Permissions
CWE-732 — Incorrect Permission Assignment for Critical Resource

References

cna@sap.com (Permissions Required)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-33990?: CVE-2023-33990 is a high-severity vulnerability in Sap Sql_anywhere, classified under Insecure Inherited Permissions. CVSS score: 7.8/10. Published 2023-07-11.
How severe is CVE-2023-33990?: High severity. CVSS v3 base score is 7.8 out of 10.