CVE-2023-32114 - Vulnerability Details

Vendors	Products
Sap	Netweaver

Link	Providers
https://launchpad.support.sap.com/#/notes/3325642
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Weaknesses	CWE-400

Type	Values Removed	Values Added
Description	SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application.	SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application.
Weaknesses		CWE-732

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32114", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2023-05-03T14:48:13.764Z", "datePublished": "2023-06-13T02:38:20.376Z", "dateUpdated": "2025-01-03T02:06:36.461Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP NetWeaver (Change and Transport System)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "702"}, {"status": "affected", "version": "731"}, {"status": "affected", "version": "740"}, {"status": "affected", "version": "750"}, {"status": "affected", "version": "751"}, {"status": "affected", "version": "752"}, {"status": "affected", "version": "753"}, {"status": "affected", "version": "754"}, {"status": "affected", "version": "755"}, {"status": "affected", "version": "756"}, {"status": "affected", "version": "757"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application.</p>"}], "value": "SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2024-09-28T21:56:20.581Z"}, "references": [{"url": "https://launchpad.support.sap.com/#/notes/3325642"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Denial of Service in SAP NetWeaver", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:03:29.114Z"}, "title": "CVE Program Container", "references": [{"url": "https://launchpad.support.sap.com/#/notes/3325642", "tags": ["x_transferred"]}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-03T02:06:20.309745Z", "id": "CVE-2023-32114", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-03T02:06:36.461Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-32114 (string)

assignerOrgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

state : PUBLISHED (string)

assignerShortName : sap (string)

dateReserved : 2023-05-03T14:48:13.764Z (string)

datePublished : 2023-06-13T02:38:20.376Z (string)

dateUpdated : 2025-01-03T02:06:36.461Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : SAP NetWeaver (Change and Transport System) (string)

vendor : SAP_SE (string)

versions : [ »

0 : { »

status : affected (string)

version : 702 (string)

}

1 : { »

status : affected (string)

version : 731 (string)

}

2 : { »

status : affected (string)

version : 740 (string)

}

3 : { »

status : affected (string)

version : 750 (string)

}

4 : { »

status : affected (string)

version : 751 (string)

}

5 : { »

status : affected (string)

version : 752 (string)

}

6 : { »

status : affected (string)

version : 753 (string)

}

7 : { »

status : affected (string)

version : 754 (string)

}

8 : { »

status : affected (string)

version : 755 (string)

}

9 : { »

status : affected (string)

version : 756 (string)

}

10 : { »

status : affected (string)

version : 757 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : <p>SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application.</p> (string)

}

]

value : SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 2.7 (number)

baseSeverity : LOW (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-732 (string)

description : CWE-732: Incorrect Permission Assignment for Critical Resource (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

shortName : sap (string)

dateUpdated : 2024-09-28T21:56:20.581Z (string)

}

references : [ »

0 : { »

url : https://launchpad.support.sap.com/#/notes/3325642 (string)

}

1 : { »

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Denial of Service in SAP NetWeaver (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T15:03:29.114Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://launchpad.support.sap.com/#/notes/3325642 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-01-03T02:06:20.309745Z (string)

id : CVE-2023-32114 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-01-03T02:06:36.461Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://launchpad.support.sap.com/#/notes/3325642", "tags": ["x_transferred"]}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:03:29.114Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32114", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-03T02:06:20.309745Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-03T02:06:31.161Z"}}], "cna": {"title": "Denial of Service in SAP NetWeaver", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP NetWeaver (Change and Transport System)", "versions": [{"status": "affected", "version": "702"}, {"status": "affected", "version": "731"}, {"status": "affected", "version": "740"}, {"status": "affected", "version": "750"}, {"status": "affected", "version": "751"}, {"status": "affected", "version": "752"}, {"status": "affected", "version": "753"}, {"status": "affected", "version": "754"}, {"status": "affected", "version": "755"}, {"status": "affected", "version": "756"}, {"status": "affected", "version": "757"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://launchpad.support.sap.com/#/notes/3325642"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2024-09-28T21:56:20.581Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32114", "state": "PUBLISHED", "dateUpdated": "2025-01-03T02:06:36.461Z", "dateReserved": "2023-05-03T14:48:13.764Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2023-06-13T02:38:20.376Z", "assignerShortName": "sap"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://launchpad.support.sap.com/#/notes/3325642 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T15:03:29.114Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-32114 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-01-03T02:06:20.309745Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-01-03T02:06:31.161Z (string)

}

]

cna : { »

title : Denial of Service in SAP NetWeaver (string)

source : { »

discovery : UNKNOWN (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 2.7 (number)

attackVector : NETWORK (string)

baseSeverity : LOW (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : LOW (string)

privilegesRequired : HIGH (string)

confidentialityImpact : NONE (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : SAP_SE (string)

product : SAP NetWeaver (Change and Transport System) (string)

versions : [ »

0 : { »

status : affected (string)

version : 702 (string)

}

1 : { »

status : affected (string)

version : 731 (string)

}

2 : { »

status : affected (string)

version : 740 (string)

}

3 : { »

status : affected (string)

version : 750 (string)

}

4 : { »

status : affected (string)

version : 751 (string)

}

5 : { »

status : affected (string)

version : 752 (string)

}

6 : { »

status : affected (string)

version : 753 (string)

}

7 : { »

status : affected (string)

version : 754 (string)

}

8 : { »

status : affected (string)

version : 755 (string)

}

9 : { »

status : affected (string)

version : 756 (string)

}

10 : { »

status : affected (string)

version : 757 (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://launchpad.support.sap.com/#/notes/3325642 (string)

}

1 : { »

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : <p>SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application.</p> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-732 (string)

description : CWE-732: Incorrect Permission Assignment for Critical Resource (string)

}

]

}

]

providerMetadata : { »

orgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

shortName : sap (string)

dateUpdated : 2024-09-28T21:56:20.581Z (string)

}

cveMetadata : { »

cveId : CVE-2023-32114 (string)

state : PUBLISHED (string)

dateUpdated : 2025-01-03T02:06:36.461Z (string)

dateReserved : 2023-05-03T14:48:13.764Z (string)

assignerOrgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

datePublished : 2023-06-13T02:38:20.376Z (string)

assignerShortName : sap (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver:702:*:*:*:*:*:*:*", "matchCriteriaId": "6A503ABF-8655-40D7-96AD-2D7F19A673AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:731:*:*:*:*:*:*:*", "matchCriteriaId": "8A9D5C5A-6963-438B-B0EA-2A621A34D8A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:740:*:*:*:*:*:*:*", "matchCriteriaId": "BFFA1591-0304-4FAE-A6A7-72D04D1F41A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:750:*:*:*:*:*:*:*", "matchCriteriaId": "7940A9AF-308E-4CE5-BA19-7A3DCF49F644", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:751:*:*:*:*:*:*:*", "matchCriteriaId": "C09428E4-45BB-414D-9F3D-AA5C73D2DD5E", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:752:*:*:*:*:*:*:*", "matchCriteriaId": "5ED0BA7D-939D-4B05-81A3-9F991C8C04F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:753:*:*:*:*:*:*:*", "matchCriteriaId": "0C2BF545-A7DC-4BB6-B894-D04CF163DD88", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:754:*:*:*:*:*:*:*", "matchCriteriaId": "A75B2F18-60BE-41B5-82CB-520F794F2004", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:755:*:*:*:*:*:*:*", "matchCriteriaId": "E31620E5-30FC-4545-A430-AAA77A66B51A", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:756:*:*:*:*:*:*:*", "matchCriteriaId": "9724E131-9893-4630-96A2-EB6032D98C58", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver:757:*:*:*:*:*:*:*", "matchCriteriaId": "8FEBCDDF-4828-45D1-A81D-FFB50261DBCA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application."}], "id": "CVE-2023-32114", "lastModified": "2024-11-21T08:02:44.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "cna@sap.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-06-13T03:15:09.393", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://launchpad.support.sap.com/#/notes/3325642"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://launchpad.support.sap.com/#/notes/3325642"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "cna@sap.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:sap:netweaver:702:*:*:*:*:*:*:* (string)

matchCriteriaId : 6A503ABF-8655-40D7-96AD-2D7F19A673AE (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:sap:netweaver:731:*:*:*:*:*:*:* (string)

matchCriteriaId : 8A9D5C5A-6963-438B-B0EA-2A621A34D8A9 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:sap:netweaver:740:*:*:*:*:*:*:* (string)

matchCriteriaId : BFFA1591-0304-4FAE-A6A7-72D04D1F41A3 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:sap:netweaver:750:*:*:*:*:*:*:* (string)

matchCriteriaId : 7940A9AF-308E-4CE5-BA19-7A3DCF49F644 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:sap:netweaver:751:*:*:*:*:*:*:* (string)

matchCriteriaId : C09428E4-45BB-414D-9F3D-AA5C73D2DD5E (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:sap:netweaver:752:*:*:*:*:*:*:* (string)

matchCriteriaId : 5ED0BA7D-939D-4B05-81A3-9F991C8C04F9 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:sap:netweaver:753:*:*:*:*:*:*:* (string)

matchCriteriaId : 0C2BF545-A7DC-4BB6-B894-D04CF163DD88 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:sap:netweaver:754:*:*:*:*:*:*:* (string)

matchCriteriaId : A75B2F18-60BE-41B5-82CB-520F794F2004 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:sap:netweaver:755:*:*:*:*:*:*:* (string)

matchCriteriaId : E31620E5-30FC-4545-A430-AAA77A66B51A (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:sap:netweaver:756:*:*:*:*:*:*:* (string)

matchCriteriaId : 9724E131-9893-4630-96A2-EB6032D98C58 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:sap:netweaver:757:*:*:*:*:*:*:* (string)

matchCriteriaId : 8FEBCDDF-4828-45D1-A81D-FFB50261DBCA (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application. (string)

}

]

id : CVE-2023-32114 (string)

lastModified : 2024-11-21T08:02:44.223 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 2.7 (number)

baseSeverity : LOW (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 1.4 (number)

source : cna@sap.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 2.7 (number)

baseSeverity : LOW (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-06-13T03:15:09.393 (string)

references : [ »

0 : { »

source : cna@sap.com (string)

tags : [ »

0 : Permissions Required (string)

]

url : https://launchpad.support.sap.com/#/notes/3325642 (string)

}

1 : { »

source : cna@sap.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Permissions Required (string)

]

url : https://launchpad.support.sap.com/#/notes/3325642 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (string)

}

]

sourceIdentifier : cna@sap.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-732 (string)

}

]

source : cna@sap.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object