CVE-2023-41367: Missing Authentication check in SAP NetWeaver (Guided Procedures)
Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admin view of specific function anonymously. On successful exploitation of vulnerability under specific circumstances, attacker can view user’s email address. There is no integrity/availability impact.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID and title?
The vulnerability ID is CVE-2023-41367 and the title is 'Due to missing authentication check in webdynpro application an unauthorized user in SAP NetWeaver'.
What is the severity of CVE-2023-41367?
The severity of CVE-2023-41367 is medium with a CVSS score of 5.3.
What is the affected software of CVE-2023-41367?
The affected software is SAP NetWeaver version 7.50.
How can an unauthorized user exploit CVE-2023-41367?
An unauthorized user can exploit CVE-2023-41367 by gaining access to the admin view of a specific function anonymously.
Are there any references available for CVE-2023-41367?
Yes, you can find references for CVE-2023-41367 at the following links: [reference1](https://me.sap.com/notes/3348142) and [reference2](https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html).