CVE-2023-32113

SAP GUI for Windows - version 7.70, 8.0, allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking it into clicking a prepared shortcut file. Depending on the authorizations of the victim, the attacker can read and modify potentially sensitive information after successful exploitation.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.8

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://launchpad.support.sap.com/#/notes/3320467	Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory
https://launchpad.support.sap.com/#/notes/3320467	Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:gui_for_windows::::::::
	cpe:2.3:a:sap:gui_for_windows:7.70:-::::::
	cpe:2.3:a:sap:gui_for_windows:7.70:patch_level1::::::
	cpe:2.3:a:sap:gui_for_windows:7.70:patch_level10::::::
	cpe:2.3:a:sap:gui_for_windows:7.70:patch_level11::::::
	cpe:2.3:a:sap:gui_for_windows:7.70:patch_level2::::::
	cpe:2.3:a:sap:gui_for_windows:7.70:patch_level3::::::
	cpe:2.3:a:sap:gui_for_windows:7.70:patch_level4::::::
	cpe:2.3:a:sap:gui_for_windows:7.70:patch_level5::::::
	cpe:2.3:a:sap:gui_for_windows:7.70:patch_level6::::::
	cpe:2.3:a:sap:gui_for_windows:7.70:patch_level7::::::
	cpe:2.3:a:sap:gui_for_windows:7.70:patch_level8::::::
	cpe:2.3:a:sap:gui_for_windows:7.70:patch_level9::::::
	cpe:2.3:a:sap:gui_for_windows:8.0:-::::::
	cpe:2.3:a:sap:gui_for_windows:8.0:patch_level1::::::

History

No history.

Information

Published : 2023-05-09 02:15

Updated : 2024-11-21 08:02

NVD link : CVE-2023-32113

Mitre link : CVE-2023-32113

CVE.ORG link : CVE-2023-32113

JSON object : View

Products Affected

sap

gui_for_windows

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2023-32113", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.8}]}, "published": "2023-05-09T02:15:12.873", "references": [{"url": "https://launchpad.support.sap.com/#/notes/3320467", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://launchpad.support.sap.com/#/notes/3320467", "tags": ["Permissions Required", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "SAP GUI for Windows - version 7.70, 8.0, allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking it into clicking a prepared shortcut file. Depending on the authorizations of the victim, the attacker can read and modify potentially sensitive information after successful exploitation.\n\n"}], "lastModified": "2024-11-21T08:02:44.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:gui_for_windows:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44424F57-EDAC-42EE-8C29-F9AA09301A46", "versionEndExcluding": "7.70"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE1286F1-B9A5-4F25-B083-272943D90023"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF605CA1-E860-4185-A358-FE967E0DE408"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D569EBA-CE95-436E-BB48-D2EF55DD9D30"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A81A5609-2ADD-4714-8783-27BC417346D1"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "181183AC-5621-4895-82E1-E91D9DCAB69A"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD057E0A-C836-46ED-ACB3-1C80CECACD60"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AEA7D81-E487-4B85-81FF-338E2C48D282"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4114FB5F-DE93-4C1F-80E2-08ADC51BC2B1"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F65D7775-75DC-4F88-AC76-C4EEC59A2DE4"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02EC1177-F290-4488-B365-F107A7CBBA09"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "532B87F7-19BF-4956-A0A6-4F76755EF1F0"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "662D074A-F79A-4936-925E-54C7DDC45BB4"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:8.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A69E51CD-C3D1-4B66-94AA-45B2A848912C"}, {"criteria": "cpe:2.3:a:sap:gui_for_windows:8.0:patch_level1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E736149-FB18-47E7-B6DA-6459D4AC235D"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}