CVE-2023-29185: Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages)

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-11 · updated 2026-06-17
Weakness: CWE-400

Description

SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters in certain circumstances which can consume the server's resources sufficiently to make it unavailable over the network without any user interaction.

Affected products

SAP NetWeaver AS ABAP (Business Server Pages application): 700, 701, 702, 731, 740, 750 (+7)

References

https://launchpad.support.sap.com/#/notes/3303060
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
https://launchpad.support.sap.com/#/notes/3303060
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Get alerted when CVE-2023-29185 or the next vulnerability affects your stack