SAP Plant Connectivity - version 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing - version 1.0, do not validate the signature of the JSON Web Token (JWT) in the HTTP request sent from SAP Digital Manufacturing. Therefore, unauthorized callers from the internal network could send service requests to PCo or the Production Connector, which could have an impact on the integrity of the integration with SAP Digital Manufacturing.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3301942 | Permissions Required |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
26 Jun 2023, 14:08
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sap
Sap digital Manufacturing Sap plant Connectivity |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.7 |
| CPE | cpe:2.3:a:sap:plant_connectivity:15.5:*:*:*:*:*:*:* cpe:2.3:a:sap:digital_manufacturing:1.0:*:*:*:*:*:*:* |
|
| References | (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory | |
| References | (MISC) https://launchpad.support.sap.com/#/notes/3301942 - Permissions Required |
13 Jun 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-13 03:15
Updated : 2024-02-28 20:13
NVD link : CVE-2023-2827
Mitre link : CVE-2023-2827
CVE.ORG link : CVE-2023-2827
JSON object : View
Products Affected
sap
- digital_manufacturing
- plant_connectivity
CWE
CWE-306
Missing Authentication for Critical Function