CVE-2023-26459

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, an attacker authenticated as a non-administrative user can craft a request which will trigger the application server to send a request to an arbitrary URL which can reveal, modify or make unavailable non-sensitive information, leading to low impact on Confidentiality, Integrity and Availability.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
SAP	NetWeaver AS for ABAP and ABAP Platform	700; 701; 702; 731; 740; 750; 751; 752; 753; 754; 755; 756; 757; 791

References

https://launchpad.support.sap.com/#/notes/3296346Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://launchpad.support.sap.com/#/notes/3296346Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Mar 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-26464.5A vulnerability has been found in TP-Link Archer C7v2 v2_en_us_180114 and classified as problematic. Affected by this vulnerability is an un CVE-2023-264605.3Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functio CVE-2023-264614.9SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML p CVE-2023-264628.1ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege esc CVE-2023-264639.8strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes wit CVE-2023-264647.5** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that CVE-2023-264656.1Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.CVE-2023-264667.8A user with non-Admin access can change a configuration file on the client to modify the Server URL.CVE-2023-264675.4A man in the middle can redirect traffic to a malicious server in a compromised configuration.CVE-2023-264689.1Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.CVE-2023-264699.8In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.CVE-2023-26478.8A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the fil