PT-2023-31265 · Sap · Sap Gui For Java+1

CVE-2023-49580 · Publicado 2023-12-11 · Atualizado 2024-09-28

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SAP GUI for Windows and SAP GUI for Java - versions SAP BASIS 755, SAP BASIS 756, SAP BASIS 757, SAP BASIS 758

Description The issue allows an unauthenticated attacker to access information which would otherwise be restricted and confidential. Additionally, it enables the attacker to create Layout configurations of the ABAP List Viewer, causing a mild impact on integrity and availability, such as increasing the response times of the AS ABAP.

Recommendations For versions SAP BASIS 755, SAP BASIS 756, SAP BASIS 757, SAP BASIS 758, consider restricting access to the ABAP List Viewer to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the creation of Layout configurations in the ABAP List Viewer to prevent integrity and availability impacts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2023-49580

Produtos afetados

Sap Gui For Java

Sap Gui For Windows

Referências · 9

• https://twitter.com/CVEnew/status/1734394497965207965 · Publicação no Twitter
• https://t.me/cvenotify/96491 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-49580 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1734464499531366425 · Publicação no Twitter
• https://t.me/cvenotify/63269 · Publicação no Telegram
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://t.me/cvenotify/64141 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-49580 · Nota de Segurança
• https://me.sap.com/notes/3385711 · Aviso do Fabricante