CVE-2023-37492: Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform
SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAPBASIS 700, SAPBASIS 701, SAPBASIS 702, SAPBASIS 731, SAPBASIS 740, SAPBASIS 750, SAPBASIS 752, SAPBASIS 753, SAPBASIS 754, SAPBASIS 755, SAPBASIS 756, SAPBASIS 757, SAPBASIS 758, SAPBASIS 793, SAPBASIS 804, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read sensitive information which can be used in a subsequent serious attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-37492?
The severity of CVE-2023-37492 is medium with a CVSS score of 6.5.
Which versions of SAP NetWeaver Application Server ABAP are affected by CVE-2023-37492?
SAP NetWeaver Application Server ABAP versions SAP_BASIS 700 to SAP_BASIS 804 are affected by CVE-2023-37492.
How can I fix CVE-2023-37492?
To fix CVE-2023-37492, apply the necessary security patches provided by SAP.
Are there any references for CVE-2023-37492?
Yes, you can refer to the following links for more information on CVE-2023-37492: [Link 1](https://me.sap.com/notes/3348000), [Link 2](https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html).
What is the Common Weakness Enumeration (CWE) ID associated with CVE-2023-37492?
The Common Weakness Enumeration (CWE) ID associated with CVE-2023-37492 is CWE-862.