Vulnerability Details : CVE-2023-35871
The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, has a vulnerability that can be exploited by an unauthenticated attacker to cause memory corruption through logical errors in memory management this may leads to information disclosure or system crashes, which can have low impact on confidentiality and high impact on the integrity and availability of the system.
Vulnerability category: Memory CorruptionInformation leak
Products affected by CVE-2023-35871
- cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:hdb_2.00:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:kernel_7.53:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:kernel_7.54:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:kernel_7.77:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:kernel_7.85:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:kernel_7.89:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.53:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:sap_extended_app_services_1:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:xs_advanced_runtime_1.00:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:7.91:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:7.92:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:7.93:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:kernel_7.91:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:kernel_7.92:*:*:*:*:*:*:*
- cpe:2.3:a:sap:web_dispatcher:kernel_7.93:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-35871
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 37 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-35871
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.7
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H |
2.2
|
5.5
|
SAP SE | |
|
9.4
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H |
3.9
|
5.5
|
NIST |
CWE ids for CVE-2023-35871
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: cna@sap.com (Secondary)
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by:
- cna@sap.com (Primary)
- nvd@nist.gov (Secondary)
References for CVE-2023-35871
-
https://me.sap.com/notes/3340735
SAP for Me: Sign InPermissions Required
-
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
SAP Patch Day BlogVendor Advisory
Jump to