PT-2023-21404 · Sap · Sap Crm

Published 2023-04-11 · Updated 2023-04-14 · CVE-2023-27897

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SAP CRM versions 700 through 713

Description The issue allows an authenticated attacker with a non-administrative role and common remote execution authorization to use a vulnerable interface and execute an application function, performing actions they would not normally be permitted to do. Depending on the function executed, this can have limited impact on confidentiality and integrity of non-critical user or application data and application availability.

Recommendations For SAP CRM versions 700 through 713, consider restricting access to the vulnerable interface until a patch is available. As a temporary workaround, limit the execution of application functions to only those necessary for operational tasks, and monitor for any unauthorized access or changes.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-27897

Affected Products

Sap Crm

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27897 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27897 · Security Note
• https://launchpad.support.sap.com/#/notes/3309056 · Note
• https://t.me/cibsecurity/61823 · Telegram Post