PT-2023-22157 · Sap · Sap Application Interface Framework

Publicado 2023-04-11 · Atualizado 2023-04-18 · CVE-2023-29109

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP BASIS 755, 756, SAP ABA 75C, 75D, 75E

Description The application allows an Excel formula injection, enabling an authorized attacker to inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed, potentially causing limited impact on the confidentiality and integrity of the application.

Recommendations For versions AIF 703, AIFX 702, S4CORE 101, SAP BASIS 755, 756, SAP ABA 75C, 75D, 75E, consider disabling the Custom Hints List feature until a patch is available to prevent Excel formula injection. Restrict access to the Tooltip field to minimize the risk of exploitation. Avoid using the Custom Hints List feature in the affected application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-1236

Identificadores relacionados

CVE-2023-29109

Produtos afetados

Sap Application Interface Framework

Referências · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://t.me/cvenotify/47968 · Publicação no Telegram
• https://t.me/cibsecurity/61830 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-29109 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-29109 · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/3115598 · Nota