SAP NetWeaver DOS via crafted request in test class
CVE-2023-27270 Published on March 14, 2023
Denial of Service (DoS) in SAP NetWeaver AS for ABAP and ABAP Platform
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain parameters, which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.
Vulnerability Analysis
CVE-2023-27270 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2023-27270 has been classified to as a Resource Exhaustion vulnerability or weakness.
Products Associated with CVE-2023-27270
stack.watch emails you whenever new vulnerabilities are published in SAP Netweaver Application Server Abap or SAP NetWeaver. Just hit a watch button to start following.
Affected Versions
SAP NetWeaver Application Server for ABAP and ABAP Platform:- Version 700 is affected.
- Version 701 is affected.
- Version 702 is affected.
- Version 731 is affected.
- Version 740 is affected.
- Version 750 is affected.
- Version 751 is affected.
- Version 752 is affected.
- Version 753 is affected.
- Version 754 is affected.
- Version 755 is affected.
- Version 756 is affected.
- Version 757 is affected.
- Version 791 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.