Lucene search

SapCVELIST:CVE-2023-27895

HistoryMar 14, 2023 - 5:08 a.m.

CVE-2023-27895 Information Disclosure vulnerability in SAP Authenticator for Android

2023-03-1405:08:09

CWE-267

sap

www.cve.org

sap

authenticator

android

information disclosure

vulnerability

cve-2023-27895

screen capture

malicious app

mobile device

otp

alphanumeric token

exploitation

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

27.5%

JSON

SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful exploitation, an attacker can read some sensitive information but cannot modify and delete the data.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Authenticator for Android",
    "vendor": "SAP",
    "versions": [
      {
        "status": "affected",
        "version": "1.3.0"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3302710

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

27.5%

JSON

Related for CVELIST:CVE-2023-27895