Improper access control in SAP GUI
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2023-49580 |
| CWE-ID | CWE-284 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
SAP GUI Other software / Other software solutions |
| Vendor | SAP |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Improper access control
EUVDB-ID: #VU84580
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-49580
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in SAP GUI for Windows and SAP GUI for Java. A remote attacker can bypass implemented security restrictions and gain access to sensitive information or create Layout configurations of the ABAP List Viewer.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSAP GUI: 7.55 - 7.58
External linkshttp://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html#2023-12
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
