PT-2023-23622 · Sap · Sap Gui For Windows

Published 2023-05-09 · Updated 2024-03-19 · CVE-2023-32113

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP GUI for Windows versions 7.70, 8.0

Description The issue allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking them into clicking a prepared shortcut file. Depending on the authorizations of the victim, the attacker can read and modify potentially sensitive information after successful exploitation.

Recommendations For SAP GUI for Windows versions 7.70 and 8.0, consider avoiding the use of shortcut files from untrusted sources until a patch is available. As a temporary workaround, restrict access to sensitive information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-32113

Affected Products

Sap Gui For Windows

References · 5

• https://osv.dev/vulnerability/CVE-2023-32113 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32113 · Security Note
• https://launchpad.support.sap.com/#/notes/3320467 · Vendor Advisory
• https://t.me/cibsecurity/63549 · Telegram Post