CVE-2023-23853: sap netweaver_application_server_abap Open Redirect

Vulnerability summary

CVE-2023-23853 is a medium (CVSS 6.1) Open Redirect vulnerability in sap netweaver_application_server_abap. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.2% of scored vulnerabilities.

Timeline

1. 14-02-2023
   PublishedVulnerability first disclosed.
2. 20-03-2025
   Last modifiedVulnerability information updated.

Description

An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, can craft a link which when clicked by an unsuspecting user can be used to redirect a user to a malicious site which could read or modify some sensitive information or expose the victim to a phishing attack. Vulnerability has no direct impact on availability.

• CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.