PT-2023-31267 · Sap · Sap Basis+2

Published 2023-12-12 · Updated 2023-12-15 · CVE-2023-49584

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Fiori launchpad versions SAP UI 750 through SAP UI 758, UI 700 200, SAP BASIS 793

Description The issue allows an attacker to use the HTTP verb POST on a read-only service, causing a low impact on the confidentiality of the application. This is related to the use of the HTTP POST verb, which is typically used for creating or updating resources, on a service that is intended to be read-only.

Recommendations For SAP Fiori launchpad versions SAP UI 750 through SAP UI 758, UI 700 200, SAP BASIS 793, consider restricting access to the read-only service to prevent unauthorized use of the HTTP POST verb until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2023-49584

Affected Products

Sap Fiori Launchpad

Sap Basis

Sap Ui

References · 5

• https://osv.dev/vulnerability/CVE-2023-49584 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49584 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://t.me/cvenotify/63738 · Telegram Post
• https://me.sap.com/notes/3406786 · Note