Lucene search

K
cvelistSapCVELIST:CVE-2023-6542
HistoryDec 12, 2023 - 1:36 a.m.

CVE-2023-6542 Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID

2023-12-1201:36:22
CWE-863
sap
www.cve.org
3
cve-2023-6542
improper export
android application components
sap emarsys sdk
lack of authorization checks
attacker
arbitrary url
deep links
device

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

7.1

Confidence

High

EPSS

0

Percentile

9.0%

Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker could navigate to arbitrary URL including application deep links on the device.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP EMARSYS SDK ANDROID",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "100"
      }
    ]
  }
]

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

7.1

Confidence

High

EPSS

0

Percentile

9.0%

Related for CVELIST:CVE-2023-6542