CVE-2023-49587

Command Injection vulnerability in SAP Solution Manager

Medium6.4EPSS 0.41%

Published: 12 Dec 2023
Updated: 26 Nov 2024
Reserved: 27 Nov 2023
Assigned by: sap

Description

SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network.

Scores

CVSS scores of CVE-2023-49587, by who scored it
Scored by	CVSS	Score	Vector
sapCNA (assigner)	3.1	Medium6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVDNVD · Modified	3.1	Medium6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.41% · top 65% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.

Weakness

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') (opens in a new tab)All about CWE-77 and its CVEs

Affected products

SAP_SE · SAP Solution Manager
- affected 720

References (2)

https://me.sap.com/notes/3395306 (opens in a new tab)x_transferred
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-49587](https://trackcve.app/badge/CVE-2023-49587.svg)](https://trackcve.app/cve/CVE-2023-49587)

Record last updated 26 Nov 2024, 14:33 UTC.