title: Improper Authorization check vulnerability in SAP Message Server
description: The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authenticated malicious user to enter the network of the SAP systems served by the attacked SAP Message server. This may lead to unauthorized read and write of data as well as rendering the system unavailable.
problem types: CWE-285: Improper Authorization
affected:
{
defaultStatus: unaffected
product: SAP Message Server
vendor: SAP_SE
versions:
status: affected, version: KERNEL 7.22
status: affected, version: KERNEL 7.53
status: affected, version: KERNEL 7.54
status: affected, version: KERNEL 7.77
status: affected, version: RNL64UC 7.22
status: affected, version: RNL64UC 7.22EXT
status: affected, version: RNL64UC 7.53
status: affected, version: KRNL64NUC 7.22
status: affected, version: KRNL64NUC 7.22EXT
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL