CVE-2023-49581: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

SAP GUI for Windows and SAP GUI for Java contain a security vulnerability (CVE-2023-49581) that was disclosed on December 11, 2023. The vulnerability affects SAP NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 700, 731, 740, and 750. This vulnerability allows an unauthenticated attacker to access restricted and confidential information (NVD, CVE).

The vulnerability has been classified as SQL Injection (CWE-89). The National Vulnerability Database has assigned a CVSS v3.1 base score of 9.4 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, while SAP SE assessed it with a CVSS score of 4.1 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L (NVD).

The vulnerability allows an unauthenticated attacker to access restricted and confidential information. Additionally, the attacker can write data to a database table, which could increase response times of the AS ABAP, resulting in mild availability impact (NVD).

SAP has released security patches to address this vulnerability. Users should refer to SAP Security Note 3392547 for detailed mitigation instructions (SAP Note).