Vulnerability in Sap Abap Platform
CVE-2023-29109
The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application.
EPSS: 0.003 (24.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Sap Abap_platform — versions 75c, 75d, 75e
- Sap Application_interface_framework — versions aif_703, aifx_702
- Sap Application Interface Framework (Message Dashboard) — versions AIF 703, AIFX 702, S4CORE 101
- Sap Basis — versions 755, 756
- Sap S4core — versions 101
Weakness classification (CWE)
References
- cna@sap.com (Permissions Required)
- cna@sap.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-29109?
- CVE-2023-29109 is a medium-severity vulnerability in Sap Abap Platform, classified under Improper Neutralization of Formula Elements in a CSV File. CVSS score: 4.4/10. Published 2023-04-11.
- How severe is CVE-2023-29109?
- Medium severity. CVSS v3 base score is 4.4 out of 10.