Lucene search

SapCVELIST:CVE-2023-35871

HistoryJul 11, 2023 - 2:41 a.m.

CVE-2023-35871 Memory Corruption vulnerability in SAP Web Dispatcher

2023-07-1102:41:03

CWE-787

sap

www.cve.org

sap

web dispatcher

memory corruption

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

37.4%

JSON

The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, has a vulnerability that can be exploited by an unauthenticated attacker to cause memory corruption through logical errors in memory management this may leads to information disclosure or system crashes, which can have low impact on confidentiality and high impact on the integrity and availability of the system.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP Web Dispatcher",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "WEBDISP 7.53"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.54"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.77"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.85"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.89"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.91"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.92"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.93"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.53"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.54 KERNEL 7.77"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.85"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.89"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.91"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.92"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.93"
      },
      {
        "status": "affected",
        "version": "KRNL64UC 7.53"
      },
      {
        "status": "affected",
        "version": "HDB 2.00"
      },
      {
        "status": "affected",
        "version": "XS_ADVANCED_RUNTIME 1.00"
      },
      {
        "status": "affected",
        "version": "SAP_EXTENDED_APP_SERVICES 1"
      }
    ]
  }
]

References

me.sap.com/notes/3340735

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

37.4%

JSON

Related for CVELIST:CVE-2023-35871