CVE-2023-27268— Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service)
Quick assessment
Affected
SAP NetWeaver AS Java (Object Analyzing Service)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP NetWeaver Application Server Java是德国思爱普（SAP）公司的一款提供了Java运行环境的应用程序服务器。该产品主要用于开发和运行Java EE应用程序。 SAP NetWeaver AS Java 7.50版本存在访问控制错误漏洞，该漏洞源于未执行必要的授权检查。攻击者可利用该漏洞连接到开放端口，利用开放命名和目录API访问服务器数据。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1078.001 · Default Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-27268
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service)
Source: CVE Program / CVE List V5
Vulnerability Description
SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability., resulting in escalation of privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
SAP NetWeaver Application Server Java 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP NetWeaver Application Server Java是德国思爱普（SAP）公司的一款提供了Java运行环境的应用程序服务器。该产品主要用于开发和运行Java EE应用程序。 SAP NetWeaver AS Java 7.50版本存在访问控制错误漏洞，该漏洞源于未执行必要的授权检查。攻击者可利用该漏洞连接到开放端口，利用开放命名和目录API访问服务器数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP | NetWeaver AS Java (Object Analyzing Service) | 7.50 | - |
|
II. Public POCs for CVE-2023-27268
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-27268
请登录查看更多情报信息。
Other References for CVE-2023-27268 (2)
Same Patch Batch · SAP · 2023-03-14 · 21 CVEs total
| CVE-2023-23857 | 9.9 CRITICAL | Improper Access Control in SAP NetWeaver AS for Java |
| CVE-2023-25616 | 9.9 CRITICAL | Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC) |
| CVE-2023-27500 | 9.6 CRITICAL | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform |
| CVE-2023-27269 | 9.6 CRITICAL | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform |
| CVE-2023-25617 | 9.0 CRITICAL | OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform |
| CVE-2023-27893 | 8.8 HIGH | Arbitrary Code Execution in SAP Solution Manager and ABAP managed systems (ST-PI) |
| CVE-2023-27501 | 8.7 HIGH | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform |
| CVE-2023-26459 | 7.4 HIGH | Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS for ABAP and ABAP Pla |
| CVE-2023-27498 | 7.2 HIGH | Memory Corruption vulnerability in SAP Host Agent (SAPOSCOL) |
| CVE-2023-25615 | 6.8 MEDIUM | SQL Injection vulnerability in SAP ABAP Platform |
| CVE-2023-26461 | 6.8 MEDIUM | XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal) |
| CVE-2023-27896 | 6.5 MEDIUM | Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platfo |
| CVE-2023-27271 | 6.5 MEDIUM | Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platfo |
| CVE-2023-27270 | 6.5 MEDIUM | Denial of Service (DoS) in SAP NetWeaver AS for ABAP and ABAP Platform |
| CVE-2023-25618 | 6.5 MEDIUM | Denial of Service (DoS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform |
| CVE-2023-26457 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Content Server |
| CVE-2023-27895 | 6.1 MEDIUM | Information Disclosure vulnerability in SAP Authenticator for Android |
| CVE-2023-26460 | 5.3 MEDIUM | Improper Access Control in SAP NetWeaver AS Java (Cache Management Service) |
| CVE-2023-24526 | 5.3 MEDIUM | Improper Access Control in SAP NetWeaver AS Java (Classload Service) |
| CVE-2023-27894 | 5.0 MEDIUM | Sensitive Information Disclosure in the SAP BusinessObjects Business Intelligence platform |
IV. Related Vulnerabilities
Same vendor: SAP
-
CVE-2023-29189
HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI) -
CVE-2023-29187
DLL Hijacking vulnerability in SapSetup (Software Installati -
CVE-2023-29186
Directory/Path Traversal vulnerability in SAP NetWeaver. -
CVE-2023-29185
Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Busine -
CVE-2023-29112
Code Injection vulnerability in SAP Application Interface Fr
Same weakness: CWE-284
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-63045
Apache HTTP Server: mod_proxy_ftp PASV address handling -
CVE-2026-76142
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the -
CVE-2026-103534
David-Crty databasement Snapshot Model snapshots SnapshotPol -
CVE-2026-102132
Kiteworks Core Privilege Escalation through Improper Access
V. Comments for CVE-2023-27268
No comments yet