PT-2023-23622 · Sap · Sap Gui For Windows

CVE-2023-32113 · Publicado 2023-05-09 · Atualizado 2024-03-19

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP GUI for Windows versions 7.70, 8.0

Description The issue allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking them into clicking a prepared shortcut file. Depending on the authorizations of the victim, the attacker can read and modify potentially sensitive information after successful exploitation.

Recommendations For SAP GUI for Windows versions 7.70 and 8.0, consider avoiding the use of shortcut files from untrusted sources until a patch is available. As a temporary workaround, restrict access to sensitive information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2023-32113

Produtos afetados

Sap Gui For Windows

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-32113 · Aviso do Fabricante
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://t.me/cibsecurity/63549 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-32113 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/3320467 · Aviso do Fabricante