cnvd-2023-40164
Vulnerability from cnvd
Title
SAP Web Dispatcher访问控制错误漏洞
Description
SAP Web Dispatcher是德国思爱普(SAP)公司的Load Balancing的核心组件,支持负载均衡,提供反向代理的功能,使得外网用户可以访问到内部应用。 SAP Web Dispatcher存在访问控制错误漏洞,该漏洞源于IP filter容易受到错误的IP网络掩码处理的影响,攻击者可利用该漏洞访问后端应用程序。
Severity
Patch Name
SAP Web Dispatcher访问控制错误漏洞的补丁
Patch Description
SAP Web Dispatcher是德国思爱普(SAP)公司的Load Balancing的核心组件,支持负载均衡,提供反向代理的功能,使得外网用户可以访问到内部应用。 SAP Web Dispatcher存在访问控制错误漏洞,该漏洞源于IP filter容易受到错误的IP网络掩码处理的影响,攻击者可利用该漏洞访问后端应用程序。目前,供应商发布了安全公告及相关补丁信息,修复了此漏洞。
Formal description

厂商已发布了漏洞修复程序,请及时关注更新: https://launchpad.support.sap.com/#/notes/3315312

Reference
https://nvd.nist.gov/vuln/detail/CVE-2023-29108
Impacted products
Name
['SAP SAP Web Dispatcher WEBDISP 7.85', 'SAP SAP Web Dispatcher 7.89', 'SAP SAP Web Dispatcher KERNEL 7.85', 'SAP SAP Web Dispatcher 7.91']
Show details on source website


{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-29108",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-29108"
    }
  },
  "description": "SAP Web Dispatcher\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684Load Balancing\u7684\u6838\u5fc3\u7ec4\u4ef6\uff0c\u652f\u6301\u8d1f\u8f7d\u5747\u8861\uff0c\u63d0\u4f9b\u53cd\u5411\u4ee3\u7406\u7684\u529f\u80fd\uff0c\u4f7f\u5f97\u5916\u7f51\u7528\u6237\u53ef\u4ee5\u8bbf\u95ee\u5230\u5185\u90e8\u5e94\u7528\u3002\n\nSAP Web Dispatcher\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eIP filter\u5bb9\u6613\u53d7\u5230\u9519\u8bef\u7684IP\u7f51\u7edc\u63a9\u7801\u5904\u7406\u7684\u5f71\u54cd\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u540e\u7aef\u5e94\u7528\u7a0b\u5e8f\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://launchpad.support.sap.com/#/notes/3315312",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-40164",
  "openTime": "2023-05-25",
  "patchDescription": "SAP Web Dispatcher\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684Load Balancing\u7684\u6838\u5fc3\u7ec4\u4ef6\uff0c\u652f\u6301\u8d1f\u8f7d\u5747\u8861\uff0c\u63d0\u4f9b\u53cd\u5411\u4ee3\u7406\u7684\u529f\u80fd\uff0c\u4f7f\u5f97\u5916\u7f51\u7528\u6237\u53ef\u4ee5\u8bbf\u95ee\u5230\u5185\u90e8\u5e94\u7528\u3002\r\n\r\nSAP Web Dispatcher\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eIP filter\u5bb9\u6613\u53d7\u5230\u9519\u8bef\u7684IP\u7f51\u7edc\u63a9\u7801\u5904\u7406\u7684\u5f71\u54cd\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u540e\u7aef\u5e94\u7528\u7a0b\u5e8f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP Web Dispatcher\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SAP SAP Web Dispatcher WEBDISP 7.85",
      "SAP SAP Web Dispatcher 7.89",
      "SAP SAP Web Dispatcher KERNEL 7.85",
      "SAP SAP Web Dispatcher 7.91"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-29108",
  "serverity": "\u4e2d",
  "submitTime": "2023-04-18",
  "title": "SAP Web Dispatcher\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…