{"id":"CVE-2023-31405","aliases":["EUVD-2023-35716","GHSA-735x-m7jj-qwvp"],"status":"published","title":"Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)","description":"SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00447,"percentile":0.39209,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-117"],"published":"2023-07-11T02:23:26Z","modified":"2026-06-17T05:56:52Z","products":[{"vendor":"sap","product":"netweaver_application_server_for_java"},{"vendor":"sap_se","product":"sap netweaver as for java (log viewer)"}],"references":[{"url":"https://me.sap.com/notes/3324732","tags":["x_transferred","Permissions Required"]},{"url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31405"},{"url":"https://github.com/advisories/GHSA-735x-m7jj-qwvp"}],"sources":{"cve":[{"id":"CVE-2023-31405","title":"Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)","description":"SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.\n\n","status":"published","published":"2023-07-11T02:23:26.873Z","modified":"2024-11-08T18:19:45.651Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T14:35:27.430605Z"}],"euvd":[{"id":"EUVD-2023-35716","description":"SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.\n\n","status":"published","published":"2023-07-11T02:23:26Z","modified":"2024-11-08T18:19:45Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:06.31936Z"}],"ghsa":[{"id":"GHSA-735x-m7jj-qwvp","title":"SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an...","description":"SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.\n\n","status":"published","published":"2023-07-11T03:30:30Z","modified":"2024-04-04T05:54:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T14:56:37.005335Z"}],"nvd":[{"id":"CVE-2023-31405","description":"SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.\n\n","status":"published","published":"2023-07-11T03:15:09.387Z","modified":"2026-06-17T05:56:52.423Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T14:08:15.127597Z"}]}}