CVE-2023-31405 Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)

Medium 5.3 Published 11 Jul 2023 Updated 8 Nov 2024

An unauthenticated attacker can modify system logs in SAP NetWeaver AS for Java via crafted network requests.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-31405?

CVE-2023-31405 is a medium-severity vulnerability in SAP_SE SAP NetWeaver AS for Java (Log Viewer), published on 11 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.

Weakness: CWE-117

Which versions are affected by CVE-2023-31405?

It affects 1 product.

Products include Sap Netweaver Application Server for Java.

How do I fix CVE-2023-31405?

No fix has been published for CVE-2023-31405 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-31405 being exploited?

There is no known exploitation of CVE-2023-31405 in the wild and no public exploit code.

Sources

Also known as GHSA-735x-m7jj-qwvp.