CVE-2023-35874

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, performs improper authentication checks for functionalities that require user identity. An attacker can perform malicious actions over the network, extending the scope of impact, causing a limited impact on confidentiality, integrity and availability.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformKRNL64NUC 722; KRNL64NUC 7.22EXT; KRNL64UC 7.22; KRNL64UC 7.22EXT; KRNL64UC 7.53; KERNEL 7.22; KERNEL 7.53; KERNEL 7.77; KERNEL 7.81; KERNEL 7.85; KERNEL 7.89; KERNEL 7.54; KERNEL 7.92; KERNEL 7.93

References

Timeline

Published
Jul 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-358755.3Missing Authorization vulnerability in Jegstudio Gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issCVE-2023-358768.1Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: fromCVE-2023-358776.1Cross-Site Request Forgery (CSRF) vulnerability in Vadym K. Extra User Details allows Stored XSS.This issue affects Extra User Details: fromCVE-2023-358784.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions.CVE-2023-358799.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQLCVE-2023-35885.4A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allowsCVE-2023-358808.8Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.49 versions.CVE-2023-358817.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WooCommerce WooCommerce One Page Checkout alCVE-2023-358825.4Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor Super Socializer plugin <= 7.13.52 versions.CVE-2023-358836.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core WCVE-2023-358846.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 3.0.5 versions.CVE-2023-358859.8CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.