title: Capture-replay vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
description: SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates information about system identity in an ambiguous format. This could lead to capture-replay vulnerability and may be exploited by malicious users to obtain illegitimate access to the system.
problem types: CWE-294 Authentication Bypass by Capture-replay
affected:
{
defaultStatus: unaffected
product: NetWeaver ABAP Server and ABAP Platform
vendor: SAP
versions:
status: affected, version: SAP_BASIS 701
status: affected, version: SAP_BASIS 702
status: affected, version: SAP_BASIS 710
status: affected, version: SAP_BASIS 711
status: affected, version: SAP_BASIS 730
status: affected, version: SAP_BASIS 731
status: affected, version: SAP_BASIS 740
status: affected, version: SAP_BASIS 750
status: affected, version: SAP_BASIS 751
status: affected, version: SAP_BASIS 752
status: affected, version: SAP_BASIS 753
status: affected, version: SAP_BASIS 754
status: affected, version: SAP_BASIS 755
status: affected, version: SAP_BASIS 756
status: affected, version: SAP_BASIS 757
status: affected, version: KERNEL 7.22
status: affected, version: KERNEL 7.53
status: affected, version: KERNEL 7.77
status: affected, version: KERNEL 7.81
status: affected, version: KERNEL 7.85
status: affected, version: KERNEL 7.89
status: affected, version: KRNL64UC 7.22
status: affected, version: KRNL64UC 7.22EXT
status: affected, version: KRNL64UC 7.53
status: affected, version: KRNL64NUC 7.22
status: affected, version: KRNL64NUC 7.22EXT
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL