CVE-2023-35871

Estado: ModificadaCrítica (9.4)—

The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, has a vulnerability that can be exploited by an unauthenticated attacker to cause memory corruption through logical errors in memory management this may leads to information disclosure or system crashes, which can have low impact on confidentiality and high impact on the integrity and availability of the system.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Puntuación base: 9.4

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.60%
Percentil entre todas las CVEs puntuadas: 47
Fecha de la puntuación: 3/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — WEB Dispatcher

CWE

CWE-787
CWE-787

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2023-35871",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-35871",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-23T16:24:29.446961Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.4,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Web Dispatcher",
          "versions": [
            {
              "status": "affected",
              "version": "WEBDISP 7.53"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.54"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.77"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.85"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.89"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.91"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.92"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.93"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.53"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.54 KERNEL 7.77"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.85"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.89"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.91"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.92"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.93"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.53"
            },
            {
              "status": "affected",
              "version": "HDB 2.00"
            },
            {
              "status": "affected",
              "version": "XS_ADVANCED_RUNTIME 1.00"
            },
            {
              "status": "affected",
              "version": "SAP_EXTENDED_APP_SERVICES 1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-07-11T03:15:09.867",
  "references": [
    {
      "url": "https://me.sap.com/notes/3340735",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://me.sap.com/notes/3340735",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, has a vulnerability that can be exploited by an unauthenticated attacker to cause memory corruption through logical errors in memory management this may leads to information disclosure or system crashes, which can have low impact on confidentiality and high impact on the integrity and availability of the system.\n\n"
    }
  ],
  "lastModified": "2026-06-17T06:05:22.837",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47D4D542-2EC2-490B-B4E9-3E7BB8D59B77"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "950DF1E2-990E-41EF-8779-CEC54C7CDC60"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E33D9481-3CF6-4AA3-B115-7903AC6DAE25"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F74EE4D5-E968-4851-89E6-4152F64930F2"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "097ED3E8-49B1-497E-BD43-28C397FBEAE8"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.91:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC165964-CB7E-40BC-A63E-7CD0E34CF93D"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.92:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C72FF95D-9A43-4788-810F-2FFE408A1CFC"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.93:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9105215B-CB70-4063-9302-138F54DD2672"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:hdb_2.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A4A56FB-16CB-4ACA-A961-01F57B1A11F2"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.53:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7E4BC89-114A-4EA3-A9E8-D956A26BCB18"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.54:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65A5FFAC-93F9-4204-9FA1-4D749D443173"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.77:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0098E57-6A7F-4CC6-8109-E2400E0FFFEB"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.85:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7ABB030-9A13-4194-A2A4-9623B2F22D7D"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.89:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB22EAAE-F75C-4902-9734-52B048D5D7B2"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.91:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2CB56066-A70F-4162-9E7F-829DE9862467"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.92:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBDC3937-9B43-46AF-B003-D5C0B181B214"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.93:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30459CD4-451D-4C3D-8FE2-17552F83D7CA"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.53:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A8CD933-E217-445A-B244-C07625F9EE74"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:sap_extended_app_services_1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "216C4CEE-E514-43FB-8819-591AF721E2ED"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:xs_advanced_runtime_1.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E9D3697-7C80-4629-AE7A-73BDE5C558B2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}