PT-2023-31267 · Sap · Sap Basis+2

Publicado 2023-12-12 · Atualizado 2023-12-15 · CVE-2023-49584

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Fiori launchpad versions SAP UI 750 through SAP UI 758, UI 700 200, SAP BASIS 793

Description The issue allows an attacker to use the HTTP verb POST on a read-only service, causing a low impact on the confidentiality of the application. This is related to the use of the HTTP POST verb, which is typically used for creating or updating resources, on a service that is intended to be read-only.

Recommendations For SAP Fiori launchpad versions SAP UI 750 through SAP UI 758, UI 700 200, SAP BASIS 793, consider restricting access to the read-only service to prevent unauthorized use of the HTTP POST verb until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

CVE-2023-49584

Produtos afetados

Sap Fiori Launchpad

Sap Basis

Sap Ui

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-49584 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-49584 · Nota de Segurança
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://t.me/cvenotify/63738 · Publicação no Telegram
• https://me.sap.com/notes/3406786 · Nota