PT-2023-31263 · Sap · Sap Cloud Connector

Published 2023-12-11 · Updated 2024-09-28 · CVE-2023-49578

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions SAP Cloud Connector version 2.0

Description The issue allows an authenticated user with low privilege to perform a Denial of Service attack from an adjacent UI by sending a malicious request. This leads to a low impact on the availability of the application, with no impact on confidentiality or integrity.

Recommendations For SAP Cloud Connector version 2.0, consider restricting access to the UI to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the ability of low-privilege users to send malicious requests to adjacent UI components.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2023-49578

Affected Products

Sap Cloud Connector

References · 9

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49578 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49578 · Security Note
• https://t.me/cvenotify/63268 · Telegram Post
• https://twitter.com/CVEnew/status/1734394498917294175 · Twitter Post
• https://me.sap.com/notes/3362463 · Note
• https://t.me/cvenotify/63737 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1734464246564413935 · Twitter Post
• https://t.me/cvenotify/96490 · Telegram Post