9.8

CVE-2023-0017: sap netweaver_application_server_for_java Improper Access Control

CVSS: 9.8v3.1CriticalModified
Published 10-01-2023Last modified 09-04-2025
Open JSON

Vulnerability summary

CVE-2023-0017 is a critical (CVSS 9.8) Improper Access Control vulnerability in sap netweaver_application_server_for_java. EPSS estimates a 15.73% chance of exploitation in the next 30 days, higher than 96.8% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
15.73%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 10-01-2023
    PublishedVulnerability first disclosed.
  2. 09-04-2025
    Last modifiedVulnerability information updated.

Description

An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data on the current system. This could allow the attacker to have full read access to user data, make modifications to user data, and make services within the system unavailable.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

15.73%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 15.73% on 21-09-2026

21-09-202621-10-2026
EPSS score
15.73%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Sap2 products

1 vendor · 2 products

References

2 links