CVE-2023-0014 Capture-replay vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Critical 9.0 Published 10 Jan 2023 Updated 9 Apr 2025

Attackers can exploit ambiguous system identity formats to perform capture-replay attacks and gain illegitimate access to SAP NetWeaver systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-0014?

CVE-2023-0014 is a critical authentication bypass vulnerability in Sap Netweaver Application Server Abap, published on 10 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates information about system identity in an ambiguous format. This could lead to capture-replay vulnerability and may be exploited by malicious users to obtain illegitimate access to the system.

Weakness: CWE-294

Which versions are affected by CVE-2023-0014?

It affects 4 products.

Products include Sap Netweaver Application Server Abap, Sap Netweaver Application Server Abap Kernel, Sap Netweaver Application Server Abap Krnl64nuc, Sap Netweaver Application Server Abap Krnl64uc.

How do I fix CVE-2023-0014?

No fix has been published for CVE-2023-0014 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-0014 being exploited?

There is no known exploitation of CVE-2023-0014 in the wild and no public exploit code.

All Sap Netweaver Application Server Abap vulnerabilities

Sources

Also known as GHSA-44h8-4xm9-fmpv.