CVE-2023-0019

Name: CVE-2023-0019
Creator: NVD / NIST
Published: 2023-02-14T04:15:10.073+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.5/10EPSS 0.53%

Last modified Jun 17, 2026

CVE-2023-0019 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality. . EPSS estimates a 0.53% chance of exploitation in the next 30 days.

Description

In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality.

Metrics

CVSS 3.1

6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

0.53%

40.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-862

Affected Software

Vendor	Product	Versions
Sap	Grc Process Control	v1100_700
Sap	Grc Process Control	v1100_731
Sap	Grc Process Control	v1200
Sap	Grc Process Control	v1200_750
Sap	Grc Process Control	v8100

References

https://launchpad.support.sap.com/#/notes/3281724Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://launchpad.support.sap.com/#/notes/3281724Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Feb 14, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-0019?

How severe is CVE-2023-0019?

CVE-2023-0019 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.53% probability of exploitation in the next 30 days.

How do I fix CVE-2023-0019?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-0019?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST