What is the severity of CVE-2023-23857?

The severity of CVE-2023-23857 is critical.

How does CVE-2023-23857 impact SAP NetWeaver AS for Java?

CVE-2023-23857 allows an unauthenticated attacker to access services and perform unauthorized operations affecting users and services across SAP NetWeaver AS for Java.

How can an attacker exploit CVE-2023-23857?

An attacker can exploit CVE-2023-23857 by attaching to an open interface and using an open naming and directory API to access services and perform unauthorized operations.

Is there a fix available for CVE-2023-23857?

Yes, SAP has released patches to address the vulnerability. Please refer to the SAP security note or the SAP website for the appropriate patch.

Where can I find more information about CVE-2023-23857?

You can find more information about CVE-2023-23857 in the SAP support note or the SAP website provided in the references section.

Vulnerability/
CVE-2023-23857

critical

9.9

CWE

287

14/3/2023

2/8/2024

CVE-2023-23857: Improper Access Control in SAP NetWeaver AS for Java

First published: Tue Mar 14 2023(Updated: )

Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and services across systems. On a successful exploitation, the attacker can read and modify some sensitive information but can also be used to lock up any element or operation of the system making that it unresponsive or unavailable.

Credit: cna@sap.com

Affected Software	Affected Version	How to fix
SAP NetWeaver Application Server for Java	=7.50

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2023-23857?
The severity of CVE-2023-23857 is critical.
How does CVE-2023-23857 impact SAP NetWeaver AS for Java?
CVE-2023-23857 allows an unauthenticated attacker to access services and perform unauthorized operations affecting users and services across SAP NetWeaver AS for Java.
How can an attacker exploit CVE-2023-23857?
An attacker can exploit CVE-2023-23857 by attaching to an open interface and using an open naming and directory API to access services and perform unauthorized operations.
Is there a fix available for CVE-2023-23857?
Yes, SAP has released patches to address the vulnerability. Please refer to the SAP security note or the SAP website for the appropriate patch.
Where can I find more information about CVE-2023-23857?
You can find more information about CVE-2023-23857 in the SAP support note or the SAP website provided in the references section.

collector/nvd-index
agent/references
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/severity
agent/title
agent/author
agent/last-modified-date
agent/weakness
agent/description
agent/tags
agent/first-publish-date
agent/event
vendor/sap
canonical/sap netweaver application server for java
version/sap netweaver application server for java/7.50

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.