7.3

CVE-2023-49580

Information disclosure in SAP GUI for Windows and SAP GUI for Java

SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to create Layout configurations of the ABAP List Viewer and with this causing a mild impact on integrity and availability, e.g. also increasing the response times of the AS ABAP.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Graphical User Interface Version sap_basis_755 SwPlatform java
SAP ≫ Graphical User Interface Version sap_basis_755 SwPlatform windows
SAP ≫ Graphical User Interface Version sap_basis_756 SwPlatform java
SAP ≫ Graphical User Interface Version sap_basis_756 SwPlatform windows
SAP ≫ Graphical User Interface Version sap_basis_757 SwPlatform java
SAP ≫ Graphical User Interface Version sap_basis_757 SwPlatform windows
SAP ≫ Graphical User Interface Version sap_basis_758 SwPlatform java
SAP ≫ Graphical User Interface Version sap_basis_758 SwPlatform windows
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.48% 0.374
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.3 3.9 3.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
SAP 7.3 3.9 3.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
Vendor Advisory
https://me.sap.com/notes/3385711
Vendor Advisory
Permissions Required