PT-2023-22191 · Sap · Sap Crm

Published 2023-04-11 · Updated 2023-04-18 · CVE-2023-29189

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP CRM (WebClient UI) versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801

Description The issue allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields.

Recommendations For SAP CRM (WebClient UI) versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, consider restricting access to the web server to minimize the risk of exploitation. As a temporary workaround, consider disabling the modification of HTTP verbs in requests to the web server until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2023-29189

Affected Products

Sap Crm

References · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29189 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29189 · Vendor Advisory
• https://t.me/cibsecurity/61831 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3269352 · Note
• https://t.me/cvenotify/48510 · Telegram Post