SAP Note 3296346

Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

HighCVSS 7.4NetWeaver AS for ABAP and ABAP Platform

Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).

CVE(s): CVE-2023-25618 CVE-2023-26459
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Affected products and versions

Product NetWeaver AS for ABAP and ABAP Platform
Versions: 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791

Appears in

Patch Days listing this note, newest first.

March 2023HighCVSS 7.4

SAP note on SAP for Me (SAP login required)