CVE-2023-0021
published 2023-03-14CVE-2023-0021: Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.46%
36.5th percentile
Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | netweaver | — | — |
| sap | netweaver | — | — |
| sap | netweaver | — | — |
| sap | netweaver | — | — |
| sap | netweaver | — | — |
| sap | netweaver | — | — |
| sap_se | sap_netweaver | — | — |
| sap_se | sap_netweaver | — | — |
| sap_se | sap_netweaver | — | — |
| sap_se | sap_netweaver | — | — |
| sap_se | sap_netweaver | — | — |
| sap_se | sap_netweaver | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-42mg-mwh3-h53h: Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code t
ghsa_unreviewed·2023-03-14
CVE-2023-0021 [MEDIUM] CWE-79 GHSA-42mg-mwh3-h53h: Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code t
Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.
VMware
VMware Aria Operations for Logs updates address multiple vulnerabilities. (CVE-2023-34051, CVE-2023-34052)
vendor_vmware·2023-10-19·CVSS 9.8
CVE-2023-34051 [CRITICAL] VMware Aria Operations for Logs updates address multiple vulnerabilities. (CVE-2023-34051, CVE-2023-34052)
VMSA-2023-0021: VMware Aria Operations for Logs updates address multiple vulnerabilities. (CVE-2023-34051, CVE-2023-34052)
VMware Aria Operations for Logs contains an authentication bypass vulnerability VMware has evaluated the severity of this issue to be in the Important Severity Range with a maximum CVSSv3 base score of 8.1.
CVEs: CVE-2023-34051, CVE-2023-34052
Affected products: VMware Aria, VMware Cloud Foundation
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-03-14
Published