Code injection

2023-08-0801:15:00

PRIOn knowledge base

www.prio-n.com

sap

message server

acl

code injection

access control

unauthorized access

nvd

8.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.9%

JSON

The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable.

CPENameOperatorVersion
message_servereqkernel-7.22
message_servereqkernel-7.53
message_servereqkernel-7.54
message_servereqkernel-7.77
message_servereqrnl64uc-7.22
message_servereqrnl64uc-7.22ext
message_servereqrnl64uc-7.53
message_servereqkrnl64nuc-7.22
message_servereqkrnl64nuc-7.22ex

Name	Operator	Version
message_server	eq	kernel-7.22
message_server	eq	kernel-7.53
message_server	eq	kernel-7.54
message_server	eq	kernel-7.77
message_server	eq	rnl64uc-7.22
message_server	eq	rnl64uc-7.22ext
message_server	eq	rnl64uc-7.53
message_server	eq	krnl64nuc-7.22
message_server	eq	krnl64nuc-7.22ex