PT-2023-22159 · Sap · Sap Aif

Published 2023-04-11 · Updated 2023-04-18 · CVE-2023-29111

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP AIF (ODATA service) versions 755, 756

Description The SAP AIF (ODATA service) discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component, causing a low impact on the confidentiality of the application.

Recommendations For versions 755 and 756, consider restricting access to sensitive information to minimize the risk of exploitation until a fix is available. As a temporary workaround, consider disabling the ODATA service until a patch is available. Restrict access to the SAP AIF component to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-29111

Affected Products

Sap Aif

References · 6

• https://osv.dev/vulnerability/CVE-2023-29111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29111 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://t.me/cibsecurity/61820 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3117978 · Note
• https://t.me/cvenotify/47966 · Telegram Post