Lucene search

SapCVE-2023-27895

HistoryMar 14, 2023 - 6:15 a.m.

CVE-2023-27895

2023-03-1406:15:12

CWE-267

sap

web.nvd.nist.gov

sap

authenticator

android

cve-2023-27895

screen capture

sensitive information

security vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

27.5%

JSON

SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful exploitation, an attacker can read some sensitive information but cannot modify and delete the data.

Affected configurations

Nvd

Node

sapauthenticatorMatch1.3.0android

VendorProductVersionCPE
sapauthenticator1.3.0cpe:2.3:a:sap:authenticator:1.3.0:*:*:*:*:android:*:*

Vendor	Product	Version	CPE
sap	authenticator	1.3.0	cpe:2.3:a:sap:authenticator:1.3.0:::::android::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Authenticator for Android",
    "vendor": "SAP",
    "versions": [
      {
        "status": "affected",
        "version": "1.3.0"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3302710

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

27.5%

JSON

Related for CVE-2023-27895