CVE-2023-25614: XSS
First published: Tue Feb 14 2023(Updated: )
SAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow an unauthenticated attacker to inject the code that can be executed by the application over the network. On successful exploitation it can gain access to the sensitive information which leads to a limited impact on the confidentiality and the integrity of the application.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver Application Server ABAP | =700 | |
| SAP NetWeaver Application Server ABAP | =701 | |
| SAP NetWeaver Application Server ABAP | =702 | |
| SAP NetWeaver Application Server ABAP | =731 | |
| SAP NetWeaver Application Server ABAP | =740 | |
| SAP NetWeaver Application Server ABAP | =750 | |
| SAP NetWeaver Application Server ABAP | =751 | |
| SAP NetWeaver Application Server ABAP | =752 | |
| SAP NetWeaver Application Server ABAP | =753 | |
| SAP NetWeaver Application Server ABAP | =754 | |
| SAP NetWeaver Application Server ABAP | =755 | |
| SAP NetWeaver Application Server ABAP | =756 | |
| SAP NetWeaver Application Server ABAP | =757 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this SAP NetWeaver AS ABAP (BSP Framework) application vulnerability?
The vulnerability ID for this SAP NetWeaver AS ABAP (BSP Framework) application vulnerability is CVE-2023-25614.
What is the severity level of CVE-2023-25614?
The severity level of CVE-2023-25614 is medium.
Which versions of SAP NetWeaver AS ABAP (BSP Framework) application are affected by CVE-2023-25614?
The versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, and 757 of SAP NetWeaver AS ABAP (BSP Framework) application are affected by CVE-2023-25614.
How can an unauthenticated attacker exploit CVE-2023-25614?
An unauthenticated attacker can exploit CVE-2023-25614 by injecting code that can be executed by the application over the network.
Are there any fixes or patches available for CVE-2023-25614?
Yes, you can find fixes or patches for CVE-2023-25614 at the following references: [link1](https://launchpad.support.sap.com/#/notes/3274585) and [link2](https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html).
- collector/nvd-index
- vendor/sap
- canonical/sap netweaver application server abap
- version/sap netweaver application server abap/700
- version/sap netweaver application server abap/701
- version/sap netweaver application server abap/702
- version/sap netweaver application server abap/731
- version/sap netweaver application server abap/740
- version/sap netweaver application server abap/750
- version/sap netweaver application server abap/751
- version/sap netweaver application server abap/752
- version/sap netweaver application server abap/753
- version/sap netweaver application server abap/754
- version/sap netweaver application server abap/755
- version/sap netweaver application server abap/756
- version/sap netweaver application server abap/757