PT-2023-31265 · Sap · Sap Gui For Java+1

Published 2023-12-11 · Updated 2024-09-28 · CVE-2023-49580

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SAP GUI for Windows and SAP GUI for Java - versions SAP BASIS 755, SAP BASIS 756, SAP BASIS 757, SAP BASIS 758

Description The issue allows an unauthenticated attacker to access information which would otherwise be restricted and confidential. Additionally, it enables the attacker to create Layout configurations of the ABAP List Viewer, causing a mild impact on integrity and availability, such as increasing the response times of the AS ABAP.

Recommendations For versions SAP BASIS 755, SAP BASIS 756, SAP BASIS 757, SAP BASIS 758, consider restricting access to the ABAP List Viewer to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the creation of Layout configurations in the ABAP List Viewer to prevent integrity and availability impacts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2023-49580

Affected Products

Sap Gui For Java

Sap Gui For Windows

References · 9

• https://osv.dev/vulnerability/CVE-2023-49580 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49580 · Security Note
• https://me.sap.com/notes/3385711 · Vendor Advisory
• https://twitter.com/CVEnew/status/1734394497965207965 · Twitter Post
• https://t.me/cvenotify/96491 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1734464499531366425 · Twitter Post
• https://t.me/cvenotify/63269 · Telegram Post
• https://t.me/cvenotify/64141 · Telegram Post