Medium severity · published Mar 14, 2023
CVE-2023-27270
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a…
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain parameters, which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Netweaver Application Server Abap · Sap
700; 701; 702; 731; 740; 750; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-27270
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-27270
Permissions Required
https://launchpad.support.sap.com/#/notes/3296328
Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
More from Netweaver Application Server Abap
10.0
CVE-2022-22536
SAP Multiple Products HTTP Request Smuggling Vulnerability
9.9
CVE-2026-0488
Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)
9.8
CVE-2023-40309
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation…
9.8
CVE-2023-0014
SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81,…
9.8
CVE-2021-44231
Internally used text extraction reports allow an attacker to inject code that can be executed by the application