CVE-2023-29108
Sap Abap Platform Kernel 7.85 … 7.91
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-29108 is a medium-severity Improper Restriction of Communication Channel to Intended Endpoints (CWE-923) vulnerability in Sap Abap Platform Kernel. Its CVSS base score is 5.0 (Medium).
Operationally, ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32711
Vulnerability Data
The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Authorizing wireless access restricts the wireless communication channel to only intended endpoints.
Approving specific exchanges and documenting interface characteristics restricts communication channels to only intended endpoints and systems.
Limits physical connectivity to transmission channels, supporting restriction of communication paths to only intended endpoints.
Requiring providers to meet communication-channel restrictions and monitoring adherence reduces improper restriction of channels to intended endpoints.
Mandates restriction of the channel for authentication to only the intended trusted endpoints, blocking unauthorized communication paths.
Explicit control of VoIP traffic forces organizations to restrict communication channels to only intended endpoints and protocols.
Explicit internal/external separation restricts name-resolution channels to their intended communication endpoints.
Enforces that the wireless communication channel is usable only by intended endpoints, addressing improper channel restriction.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls directly enforce endpoint validation and channel restrictions.
A.8.21 mandates identifying/implementing network service security features (authentication, encryption, connection controls, authorization, monitoring, allowed endpoints via rules) and ensuring providers do so, which stops most improper-restriction cases from being exploitable; the bounded remainder is product-level endpoint validation logic (e.g. cert pinning, strict hostname checks) that lives in code rather than in service configuration or provider agreement.
Cryptography can protect channels but does not guarantee correct endpoint identity without additional controls.
Application security requirements may specify endpoint validation but do not implement it.
A.8.27 mandates security-by-design principles (defense-in-depth, least privilege, assume-breach, never-trust/always-verify, end-to-end encryption, dynamic access control) plus design reviews that can stop many channel-misrouting flaws at source, but leaves a bounded remainder (e.g. flawed protocol selection or implementation bugs in the chosen channel that still reach the wrong endpoint).
Secure coding practices can implement endpoint checks but the control itself is process-oriented.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-923, a class-level weakness. Rules are authored against its narrower children: CWE-419.