TI-2023-16857 Aliases CVE-2023-33990 GHSA-fj2m-7r3q-j27x

Denial of Service (DoS) vulnerability in SAP SQL Anywhere

LOW 35CWE-277Published 2023-07-11 · Updated 2024-11-08

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory objects. This can be leveraged by an attacker to perform a Denial of Service. Further, an attacker might be able to modify sensitive data in shared memory objects.This issue only affects SAP SQL Anywhere on Windows. Other platforms are not impacted.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00159 5th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP SQL Anywhere	17.0	—	No fix listed	CNA

SAP SQL Anywhere VendorSAP Affected 17.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:sql_anywhere:17.0:::::::*	17.0	Vulnerable	SAP

cpe:2.3:a:sap:sql_anywhere:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-33990
2026-10-03 Alias added: GHSA-fj2m-7r3q-j27x

References

Advisory 1

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Other 1

https://me.sap.com/notes/3331029

TI-2022-15977 Stack-based buffer overflow in SAP SQL Anywhere CVSS 3.1CRITICAL 9.8
TI-2014-07519 Stack-based buffer overflow in the .NET Data Provider in SAP SQL Anywhere allows remote… CVSS 2.0HIGH 7.5
TI-2022-10650 SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate… CVSS 3.1MEDIUM 6.5
TI-2022-19767 SQL injection in SAP SQL Anywhere CVSS 3.1MEDIUM 6.5
TI-2015-02490 SAP Sybase SQL Anywhere 11 and 16 allows remote attackers to cause a denial of service… CVSS 2.0MEDIUM 5.0
TI-2016-08372 Buffer overflow in the MobiLink Synchronization Server component in SAP SQL Anywhere 17… CVSS 3.0MEDIUM 4.9

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences