March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – Multiple Juniper Networks Junos OS and Junos OS Evolved Vulnerabilities
October 12, 2023
Rewterz Threat Advisory – Multiple F5-Big IP Vulnerabilities
October 12, 2023
Rewterz Threat Advisory – Multiple Juniper Networks Junos OS and Junos OS Evolved Vulnerabilities
October 12, 2023
Rewterz Threat Advisory – Multiple F5-Big IP Vulnerabilities
October 12, 2023
Severity
High
Analysis Summary
CVE-2023-42477 CVSS:6.5
SAP NetWeaver AS Java is vulnerable to server-side request forgery, caused by a flaw in the GRMG Heartbeat application. By sending a specially crafted request, an attacker could exploit this vulnerability to conduct SSRF attack.
CVE-2023-42475 CVSS:4.3
SAP S/4HANA Core could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the Statutory Reporting. By sending a specially crafted request, an attacker could exploit this vulnerability to read server files, and use this information to launch further attacks against the affected system.
CVE-2023-42474 CVSS:6.8
SAP BusinessObjects Web Intelligence is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVE-2023-42473 CVSS:5.4
SAP S/4HANA could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper authorization validation. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
CVE-2023-41365 CVSS:4.3
SAP Business One could allow a remote authenticated attacker to obtain sensitive information, caused by the generation of sensitive information in error message. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain the details stack trace of the fault message, and use this information to launch further attacks against the affected system.
CVE-2023-40310 CVSS:6.5
SAP PowerDesigner Client is vulnerable to a denial of service, caused by improper validation of BPMN2 XML document imported from an untrusted source. By persuading a victim to open a specially crafted content, a remote attacker could exploit this vulnerability to cause a denial of service condition.
Impact
- Gain Access
- Information Theft
- Cross-Site Scripting
- Privileges Escalation
- Denial of Service
Indicators Of Compromise
CVE
- CVE-2023-42477
- CVE-2023-42475
- CVE-2023-42474
- CVE-2023-42473
- CVE-2023-41365
- CVE-2023-40310
Affected Vendors
SAP
Affected Products
- SAP NetWeaver AS for JAVA 7.50
- SAP Business One 10.0
- SAP PowerDesigner Proxy 16.7
- SAP S/4Hana Core S4CORE 102
- SAP S/4Hana Core S4CORE 103
- SAP S/4Hana Core S4CORE 104
- SAP S/4Hana Core S4CORE 105
- SAP S/4Hana Core S4CORE 106
- SAP S/4HANA Core SAPSCORE 128
- SAP BusinessObjects Web Intelligence 420
- SAP S/4HANA 106
Remediation
Refer to SAP Security Advisory for patch information, available from the SAP Web site. Login required.