CVE-2023-37491

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
SAP_SE	SAP Message Server	KERNEL 7.22; KERNEL 7.53; KERNEL 7.54; KERNEL 7.77; RNL64UC 7.22; RNL64UC 7.22EXT; RNL64UC 7.53; KRNL64NUC 7.22; KRNL64NUC 7.22EXT

References

https://me.sap.com/notes/3344295Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://me.sap.com/notes/3344295Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Aug 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-374926.5SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740 CVE-2023-374955.9Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in t CVE-2023-374965.4HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser t CVE-2023-374978.8The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certai CVE-2023-374988.8A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an CVE-2023-374996.1A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack CVE-2023-37505.3A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race conditi CVE-2023-375006.1A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a use CVE-2023-375016.1A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user's session and perfo CVE-2023-375028.8HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by th CVE-2023-375039.8HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts.CVE-2023-375046.5HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out fun