CVE-2023-49581 SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

Medium 4.1 Published 12 Dec 2023 Updated 2 Aug 2024

Unauthenticated attackers can read confidential data and modify database tables in SAP NetWeaver ABAP, potentially degrading system availability.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-49581?

CVE-2023-49581 is a medium-severity SQL injection vulnerability in Sap Netweaver Application Server Abap, published on 12 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase response times of the AS ABAP, leading to mild impact on availability.

Weakness: CWE-89

Which versions are affected by CVE-2023-49581?

It affects 1 product.

Products include Sap Netweaver Application Server Abap.

How do I fix CVE-2023-49581?

No fix has been published for CVE-2023-49581 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2023-49581 being exploited?

There is no known exploitation of CVE-2023-49581 in the wild and no public exploit code.

All Sap Netweaver Application Server Abap vulnerabilities

Sources

Also known as GHSA-ghxm-9fh8-8p5g.