CVE-2023-27895: Information Disclosure vulnerability in SAP Authenticator for Android
First published: Tue Mar 14 2023(Updated: )
SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful exploitation, an attacker can read some sensitive information but cannot modify and delete the data.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sap Authenticator | =1.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-27895?
CVE-2023-27895 has been classified as a high severity vulnerability.
How do I fix CVE-2023-27895?
To mitigate CVE-2023-27895, users should update to a newer version of SAP Authenticator, or avoid installing untrusted apps.
What type of vulnerability is CVE-2023-27895?
CVE-2023-27895 is a mobile application vulnerability that allows screen capturing by malicious apps.
What are the potential impacts of CVE-2023-27895?
The potential impact of CVE-2023-27895 includes unauthorized access to sensitive information like OTPs.
Who is affected by CVE-2023-27895?
CVE-2023-27895 affects users of SAP Authenticator for Android version 1.3.0.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/event
- agent/description
- agent/tags
- agent/source
- vendor/sap
- canonical/sap authenticator
- version/sap authenticator/1.3.0