SAP BASIS
At a glance
- Source
- NVD
- EPSS
- EPSS 0.92 % · percentile 60 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Modified
Description
Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authenticated non-administrator attacker to access a system class and execute any of its public methods with parameters provided by the attacker. On successful exploitation the attacker can have full control of the system to which the class belongs, causing a high impact on the integrity of the application.
Weaknesses (CWE)
- CWE-94 — Improper Control of Generation of Code
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | sap |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-44473
- GCVE · GCVE-0-2022-41264
CERT-FR advisories
- CERTFR-2023-AVI-0125 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2022-AVI-1101 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:basis:7.31:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.40:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.50:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.51:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.52:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.53:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.54:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.55:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.56:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.57:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.89:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.90:*:*:*:*:*:*:*cpe:2.3:a:sap:basis:7.91:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP · BASIS | affected 731 ; affected 740 ; affected 750 ; affected 751 ; affected 752 ; affected 753 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |