CVE-2023-37491

Improper Authorization check vulnerability in SAP Message Server

State: Published
Severity: 7.5 High
Published: Aug 8, 2023
Updated: Oct 22, 2024
Reserved: Jul 6, 2023

Description

The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	sap

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
SAP Message ServerSAP_SE	KERNEL 7.22Affected KERNEL 7.53Affected KERNEL 7.54Affected KERNEL 7.77Affected RNL64UC 7.22Affected RNL64UC 7.22EXTAffected RNL64UC 7.53Affected KRNL64NUC 7.22Affected KRNL64NUC 7.22EXTAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.