sap message-server CVE-2023-37491 is a vulnerability in SAP Message Server
Published on August 8, 2023

The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2023-37491 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

What is an AuthZ Vulnerability?

The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

CVE-2023-37491 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2023-37491

You can be notified by stack.watch whenever vulnerabilities like CVE-2023-37491 are published in these products:

SAP Message Server
 

What versions of Message Server are vulnerable to CVE-2023-37491?