What is CVE-2023-29189?

CVE-2023-29189 is a medium-severity vulnerability in SAP Crm (Webclient Ui), classified under Relative Path Traversal. CVSS score: 5.4/10. Published 2023-04-11.

How severe is CVE-2023-29189?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Path Traversal in SAP Crm (Webclient Ui)

CVE-2023-29189

SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields

Published 2023-04-11 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

EPSS exploit prediction

EPSS: 0.004 (36.0th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

SAP Crm (Webclient Ui) — versions S4FND 102, S4FND 103, S4FND 104
SAP Customer Relationship Management S4fnd — versions 102, 103, 104
SAP Customer Relationship Management Webclient Ui — versions 700, 701, 730

Weakness classification (CWE)

CWE-23 — Relative Path Traversal

References

launchpad.support.sap.com/ (Permissions Required)
www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (Vendor Advisory)

Frequently asked questions

What is CVE-2023-29189?: CVE-2023-29189 is a medium-severity vulnerability in SAP Crm (Webclient Ui), classified under Relative Path Traversal. CVSS score: 5.4/10. Published 2023-04-11.
How severe is CVE-2023-29189?: Medium severity. CVSS v3 base score is 5.4 out of 10.