CVE-2023-2827: Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital

Published Jun 13, 2023

Updated

SAP Plant Connectivity - version 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing - version 1.0, do not validate the signature of the JSON Web Token (JWT) in the HTTP request sent from SAP Digital Manufacturing. Therefore, unauthorized callers from the internal network could send service requests to PCo or the Production Connector, which could have an impact on the integrity of the integration with SAP Digital Manufacturing.

Affected Software

2 affected components

All of the following

SAP Digital Manufacturing=1.0

SAP Plant Connectivity=15.5

Event History

Jun 13, 2023

CVE Published

via MITRE·02:36 AM

Data Sourced

via MITRE·02:36 AM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2023-2827?

CVE-2023-2827 has a high severity due to the lack of signature validation for JSON Web Tokens, allowing unauthorized access.

How do I fix CVE-2023-2827?

To fix CVE-2023-2827, update to the latest version of SAP Plant Connectivity or SAP Digital Manufacturing where JWT signature validation is implemented.

Which versions are affected by CVE-2023-2827?

CVE-2023-2827 affects SAP Plant Connectivity version 15.5 and SAP Digital Manufacturing version 1.0.

What is the potential impact of CVE-2023-2827?

The potential impact of CVE-2023-2827 includes unauthorized access to systems and data due to the absence of proper JWT validation.

Who is affected by CVE-2023-2827?

Organizations using SAP Plant Connectivity version 15.5 or SAP Digital Manufacturing version 1.0 are affected by CVE-2023-2827.