CVE-2023-24521
Full vulnerability record from the local CVENow database.
Description
Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.
Severity
MEDIUM
CVSS score
6.1
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2023-02-14 04:15:12.317000
Last modified
2026-10-28 19:10:00.193000
View original CVE JSON
{
"id": "CVE-2023-24521",
"sourceIdentifier": "[email protected]",
"published": "2023-02-14T04:15:12.317",
"lastModified": "2026-10-28T19:10:00.193",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.\n\n"
},
{
"lang": "es",
"value": "Debido a la insuficiente saneamiento de entrada, SAP NetWeaver AS ABAP (BSP framework) - versiones 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, permite a un usuario no autenticado alterar la sesión actual del usuario inyectando el código malicioso a través de la red y obtener acceso a datos no deseados. Esto puede llevar a un impacto limitado en la confidencialidad y la integridad de la aplicación."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "SAP",
"product": "NetWeaver AS ABAP (BSP Framework)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "700",
"status": "affected"
},
{
"version": "701",
"status": "affected"
},
{
"version": "702",
"status": "affected"
},
{
"version": "731",
"status": "affected"
},
{
"version": "740",
"status": "affected"
},
{
"version": "750",
"status": "affected"
},
{
"version": "751",
"status": "affected"
},
{
"version": "752",
"status": "affected"
},
{
"version": "753",
"status": "affected"
},
{
"version": "754",
"status": "affected"
},
{
"version": "755",
"status": "affected"
},
{
"version": "756",
"status": "affected"
},
{
"version": "757",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-03-21T14:03:17.636753Z",
"id": "CVE-2023-24521",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:700:*:*:*:*:*:*:*",
"matchCriteriaId": "C730F7F7-B228-4D3E-BC02-33EE5D695D69"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:701:*:*:*:*:*:*:*",
"matchCriteriaId": "EE253C97-C802-476B-81FB-BA4FC15B433C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:702:*:*:*:*:*:*:*",
"matchCriteriaId": "4DCD414F-0C97-4657-BF48-11DA3A83850E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:731:*:*:*:*:*:*:*",
"matchCriteriaId": "C167C76A-0F85-47F3-A90E-8DA4EA8C3B74"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:740:*:*:*:*:*:*:*",
"matchCriteriaId": "FF90E047-B917-4C52-8A5B-99BFA094E90D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:750:*:*:*:*:*:*:*",
"matchCriteriaId": "DAE99B15-44F0-47A1-AD2F-D92BCCA940F8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:751:*:*:*:*:*:*:*",
"matchCriteriaId": "C00F292E-E761-47AA-A82D-456CBA829BDD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:752:*:*:*:*:*:*:*",
"matchCriteriaId": "4662F413-B285-4310-AA7C-D8AD60E024DE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:753:*:*:*:*:*:*:*",
"matchCriteriaId": "76D5B33D-9FFE-4492-8879-5738CD963D09"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:754:*:*:*:*:*:*:*",
"matchCriteriaId": "C2C50935-7C21-4248-A707-60E08FA860DC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:755:*:*:*:*:*:*:*",
"matchCriteriaId": "4032AD23-8EFE-4A7B-84C3-B658F8F639DF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:756:*:*:*:*:*:*:*",
"matchCriteriaId": "A880DFD9-F853-476C-8D1C-C0B4CEC421A2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:757:*:*:*:*:*:*:*",
"matchCriteriaId": "6CBA26E7-9DB8-4960-8528-7D382B2C4C9C"
}
]
}
]
}
],
"references": [
{
"url": "https://launchpad.support.sap.com/#/notes/3269151",
"source": "[email protected]",
"tags": [
"Permissions Required",
"Vendor Advisory"
]
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://launchpad.support.sap.com/#/notes/3269151",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required",
"Vendor Advisory"
]
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
}
]
}