CVE-2023-0023

In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. They might get captured in log files, bookmarks, and so on disclosing sensitive data of the application.

CVSS v3 4.5 MEDIUM

4.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://launchpad.support.sap.com/#/notes/3150704	Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory
https://launchpad.support.sap.com/#/notes/3150704	Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:bank_account_management:800:::::::*
	cpe:2.3:a:sap:bank_account_management:900:::::::*

History

21 Nov 2024, 07:36

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~5.7~~	v2 : unknown v3 : 4.5
References	~~() https://launchpad.support.sap.com/#/notes/3150704 - Permissions Required, Vendor Advisory~~	() https://launchpad.support.sap.com/#/notes/3150704 - Permissions Required, Vendor Advisory
References	~~() https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory~~	() https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory
Summary		(es) En la aplicación SAP Bank Account Management (Manage Banks), cuando un usuario hace clic en un enlace inteligente para navegar a otra aplicación, los datos personales se muestran directamente en la URL. Es posible que queden capturados en archivos de registro, marcadores, etc., que revelen datos confidenciales de la aplicación.

Information

Published : 2023-01-10 04:15

Updated : 2024-11-21 07:36

NVD link : CVE-2023-0023

Mitre link : CVE-2023-0023

CVE.ORG link : CVE-2023-0023

JSON object : View

Products Affected

sap

bank_account_management

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2023-0023", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.1}]}, "published": "2023-01-10T04:15:10.187", "references": [{"url": "https://launchpad.support.sap.com/#/notes/3150704", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://launchpad.support.sap.com/#/notes/3150704", "tags": ["Permissions Required", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. They might get captured in log files, bookmarks, and so on disclosing sensitive data of the application."}, {"lang": "es", "value": "En la aplicaci\u00f3n SAP Bank Account Management (Manage Banks), cuando un usuario hace clic en un enlace inteligente para navegar a otra aplicaci\u00f3n, los datos personales se muestran directamente en la URL. Es posible que queden capturados en archivos de registro, marcadores, etc., que revelen datos confidenciales de la aplicaci\u00f3n."}], "lastModified": "2024-11-21T07:36:24.870", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:bank_account_management:800:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "963456EB-CC8B-4705-B2B5-7AD2014F412F"}, {"criteria": "cpe:2.3:a:sap:bank_account_management:900:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "220EFF78-6FB8-4897-84D1-CB63746E22E2"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}