Advisory
On 12.12.2023 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP Cloud Connector.
SAP Note 3362463 addresses "[CVE-2023-49578] Denial of service (DOS) in SAP Cloud Connector" to prevent denial of service (dos) with a low risk for exploitation.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Denial of Service (DoS) attacks that take a system offline may lead to significant cost for the company, studies quantify the costs in average between 4 and 5 millions dollars. Business continuity requires SAP systems staying online. The CVSS scores or vulnerability descriptions are not enough to represent how a simple bug can lead to a significant loss for companies.
Risk specification
SAP Cloud Connector allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious request.Solution
The application no longer allows an attacker to perform this type of Denial of Service attack
- 7.5 [CVE-2021-21446] Denial of service (DOS) in SAP NetWeaver AS ABAP and ABAP Platform
- 7.5 [CVE-2023-44487 ] Denial of service (DOS) in SAP HANA XS Classic and HANA XS Advanced
- 7.5 [CVE-2023-40308] Memory Corruption vulnerability in SAP CommonCryptoLib
- 7.5 [CVE-2021-20223] Multiple Vulnerabilities in SQlite bundled with SAPUI5
- 6.5 [CVE-2022-41259] Denial of service (DOS) in SAP SQL Anywhere
