Lucene search

K
cve[email protected]CVE-2023-26461
HistoryMar 14, 2023 - 5:15 a.m.

CVE-2023-26461

2023-03-1405:15:30
CWE-611
web.nvd.nist.gov
17
cve-2023-26461
sap netweaver
xml parser
vulnerability
nvd
security
data access

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.6%

SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to access but not modify sensitive files and data. It allows the attacker to view sensitive data which is owned by certain privileges.

Affected configurations

NVD
Node
sapnetweaver_enterprise_portalMatch7.50

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "NetWeaver (SAP Enterprise Portal)",
    "vendor": "SAP",
    "versions": [
      {
        "status": "affected",
        "version": "7.50"
      }
    ]
  }
]

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.6%

Related for CVE-2023-26461