CVE-2023-23857: Improper Access Control in SAP NetWeaver AS for Java
Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and services across systems. On a successful exploitation, the attacker can read and modify some sensitive information but can also be used to lock up any element or operation of the system making that it unresponsive or unavailable.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-23857?
The severity of CVE-2023-23857 is critical.
How does CVE-2023-23857 impact SAP NetWeaver AS for Java?
CVE-2023-23857 allows an unauthenticated attacker to access services and perform unauthorized operations affecting users and services across SAP NetWeaver AS for Java.
How can an attacker exploit CVE-2023-23857?
An attacker can exploit CVE-2023-23857 by attaching to an open interface and using an open naming and directory API to access services and perform unauthorized operations.
Is there a fix available for CVE-2023-23857?
Yes, SAP has released patches to address the vulnerability. Please refer to the SAP security note or the SAP website for the appropriate patch.
Where can I find more information about CVE-2023-23857?
You can find more information about CVE-2023-23857 in the SAP support note or the SAP website provided in the references section.