PT-2023-15951 · Sap · Sap Grc

Published 2023-02-14 · Updated 2023-02-21 · CVE-2023-0019

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP GRC (Process Control) versions GRCFND A V8100 through GRCFND A V1200 SAP GRC (Process Control) versions GRCPINW V1100 700 through GRCPINW V1200 750

Description The issue allows an authenticated attacker with minimal privileges to access all confidential data stored in the database through a remote-enabled function module in the proprietary SAP solution. Successful exploitation can expose user credentials from client-specific tables of the database, leading to a high impact on confidentiality.

Recommendations For SAP GRC (Process Control) versions GRCFND A V8100 through GRCFND A V1200, consider disabling the remote-enabled function module until a patch is available. For SAP GRC (Process Control) versions GRCPINW V1100 700 through GRCPINW V1200 750, restrict access to the function module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-0019

Affected Products

Sap Grc

References · 5

• https://osv.dev/vulnerability/CVE-2023-0019 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0019 · Security Note
• https://launchpad.support.sap.com/#/notes/3281724 · Note
• https://t.me/cibsecurity/58061 · Telegram Post