CVE-2023-27893
Last modified
CVE-2023-27893 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems (ST-PI) - versions 2088_1_700, 2008_1_710, 740, can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can read or modify any user or application data and can make the application unavailable. . EPSS estimates a 1.18% chance of exploitation in the next 30 days.
Description
An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems (ST-PI) - versions 2088_1_700, 2008_1_710, 740, can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can read or modify any user or application data and can make the application unavailable.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Solution Manager | 740 |
References
- https://launchpad.support.sap.com/#/notes/3296476Permissions Required
- https://launchpad.support.sap.com/#/notes/3296476Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-27893?
How severe is CVE-2023-27893?
How do I fix CVE-2023-27893?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-27888Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 an…5.4
- CVE-2023-27889Cross-site request forgery (CSRF) vulnerability in LIQUID SP…8.8
- CVE-2023-2789A vulnerability was found in GNU cflow 1.7. It has been rate…7.5
- CVE-2023-27890The Export User plugin through 2.0 for MyBB allows XSS durin…5.4
- CVE-2023-27891rami.io pretix before 4.17.1 allows OAuth application author…7.5
- CVE-2023-27892Insufficient length checks in the ShapeShift KeepKey hardwar…5.7
- CVE-2023-27894SAP BusinessObjects Business Intelligence Platform (Web Serv…5.3
- CVE-2023-27895SAP Authenticator for Android - version 1.3.0, allows the sc…6.5
- CVE-2023-27896In SAP BusinessObjects Business Intelligence Platform - vers…7.5
- CVE-2023-27897In SAP CRM - versions 700, 701, 702, 712, 713, an attacker w…6.3
- CVE-2023-27898Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 th…9.6
- CVE-2023-27899Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a…7
Are you affected by CVE-2023-27893?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST