SAP NetWeaver AS ABAP におけるクロスサイトスクリプティングの脆弱性
| Title |
SAP NetWeaver AS ABAP におけるクロスサイトスクリプティングの脆弱性
|
| Summary |
SAP NetWeaver AS ABAP には、クロスサイトスクリプティングの脆弱性が存在します。
|
| Possible impacts |
情報を取得される、および情報を改ざんされる可能性があります。 |
| Solution |
CVE-2023-24522 |
| Publication Date |
Feb. 13, 2023, midnight |
| Registration Date |
Sept. 12, 2023, 9:58 a.m. |
| Last Update |
Sept. 12, 2023, 9:58 a.m. |
|
CVSS3.0 : 警告
|
| Score |
6.1
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected System
| SAP |
|
SAP Netweaver Application Server ABAP 700
|
|
SAP Netweaver Application Server ABAP 701
|
|
SAP Netweaver Application Server ABAP 702
|
|
SAP Netweaver Application Server ABAP 731
|
|
SAP Netweaver Application Server ABAP 740
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2023年09月12日]
掲載 |
Sept. 12, 2023, 9:58 a.m. |
NVD Vulnerability Information
CVE-2023-24522
| Summary |
Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.
|
| Publication Date |
Feb. 14, 2023, 1:15 p.m. |
| Registration Date |
Feb. 14, 2023, 4 p.m. |
| Last Update |
Nov. 21, 2024, 4:48 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* |
|
|
|
|
| cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:* |
|
|
|
|
| cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* |
|
|
|
|
| cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* |
|
|
|
|
| cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* |
|
|
|
|
Related information, measures and tools
Common Vulnerabilities List