CVE-2023-0019
Last modified
CVE-2023-0019 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality. . EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Grc Process Control | v1100_700 |
| Sap | Grc Process Control | v1100_731 |
| Sap | Grc Process Control | v1200 |
| Sap | Grc Process Control | v1200_750 |
| Sap | Grc Process Control | v8100 |
References
- https://launchpad.support.sap.com/#/notes/3281724Permissions Required
- https://launchpad.support.sap.com/#/notes/3281724Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-0019?
How severe is CVE-2023-0019?
How do I fix CVE-2023-0019?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-0013The ABAP Keyword Documentation of SAP NetWeaver Application …6.1
- CVE-2023-0014SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_B…9.8
- CVE-2023-0015In SAP BusinessObjects Business Intelligence Platform (Web I…5.4
- CVE-2023-0016SAP BPC MS 10.0 - version 810, allows an unauthorized attack…8.8
- CVE-2023-0017An unauthenticated attacker in SAP NetWeaver AS for Java - v…9.8
- CVE-2023-0018Due to improper input sanitization of user-controlled input …6.1
- CVE-2023-0020SAP BusinessObjects Business Intelligence platform - version…7.1
- CVE-2023-0021Due to insufficient encoding of user input, SAP NetWeaver - …6.1
- CVE-2023-0022SAP BusinessObjects Business Intelligence Analysis edition f…8.8
- CVE-2023-0023In SAP Bank Account Management (Manage Banks) application, w…5.7
- CVE-2023-0024SAP Solution Manager (BSP Application) - version 720, allows…5.4
- CVE-2023-0025SAP Solution Manager (BSP Application) - version 720, allows…5.4
Are you affected by CVE-2023-0019?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST