CVE-2023-29189

SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://launchpad.support.sap.com/#/notes/3269352	Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:customer_relationship_management_s4fnd:102:::::::*
	cpe:2.3:a:sap:customer_relationship_management_s4fnd:103:::::::*
	cpe:2.3:a:sap:customer_relationship_management_s4fnd:104:::::::*
	cpe:2.3:a:sap:customer_relationship_management_s4fnd:105:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:700:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:701:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:730:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:731:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:746:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:747:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:748:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:800:::::::*
	cpe:2.3:a:sap:customer_relationship_management_webclient_ui:801:::::::*

History

18 Apr 2023, 19:12

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-04-11 04:16

Updated : 2024-02-04 23:37

NVD link : CVE-2023-29189

Mitre link : CVE-2023-29189

CVE.ORG link : CVE-2023-29189

JSON object : View

Products Affected

sap

customer_relationship_management_webclient_ui
customer_relationship_management_s4fnd

CWE

NVD-CWE-noinfo CWE-23

Relative Path Traversal

{"id": "CVE-2023-29189", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2023-04-11T04:16:09.283", "references": [{"url": "https://launchpad.support.sap.com/#/notes/3269352", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields\n\n"}], "lastModified": "2023-04-18T19:12:51.917", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:customer_relationship_management_s4fnd:102:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8E0DA63-3FA7-4CC4-A14E-852A632C41BC"}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_s4fnd:103:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "378861FE-CD5D-49A9-8245-538A91190064"}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_s4fnd:104:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA1262DB-E4C8-4298-B423-5EF859CE722F"}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_s4fnd:105:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9D85325-56C8-4043-BDA8-C94FE946B912"}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:700:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "714452CB-D258-4BB8-A275-A860F644C505"}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:701:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F220D25-9344-482A-A36C-9D743EA55DE8"}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:730:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0075805-C6FC-4E0D-9E1B-6ABA3A69F6C2"}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:731:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48791122-7265-4C51-8AEB-DEBC199F9A7F"}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:746:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9EEA160-B4B4-45E9-84C8-C26E52D6F329"}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:747:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8BDBE717-ADB6-4080-A198-E468080F82B2"}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:748:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B8775BD-EAB8-4F08-B65D-35B704C0E36B"}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:800:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BFCEADC-7359-470F-A412-5B2808CF6069"}, {"criteria": "cpe:2.3:a:sap:customer_relationship_management_webclient_ui:801:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A387786F-F4F6-44FC-B969-6FB92A1AA096"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}