CVE-2023-29109: Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)
First published: Tue Apr 11 2023(Updated: )
The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP ABAP | =75c | |
| SAP ABAP | =75d | |
| SAP ABAP | =75e | |
| SAP Application Interface Framework | =aif_703 | |
| SAP Application Interface Framework | =aifx_702 | |
| SAP Basis Component 700 | =755 | |
| SAP Basis Component 700 | =756 | |
| SAP S/4HANA | =101 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this SAP vulnerability?
The vulnerability ID of this SAP vulnerability is CVE-2023-29109.
What is the severity of CVE-2023-29109?
The severity of CVE-2023-29109 is medium (4.6).
What is the affected software for CVE-2023-29109?
The affected software for CVE-2023-29109 includes SAP ABAP Platform versions 75C, 75D, and 75E, SAP Application Interface Framework versions AIF 703 and AIFX 702, SAP Basis versions 755 and 756, and Sap S4core version 101.
What is the impact of CVE-2023-29109?
CVE-2023-29109 allows an authorized attacker to inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints.
How can I mitigate the vulnerability CVE-2023-29109?
To mitigate CVE-2023-29109, apply the security patches provided by SAP and follow the recommendations mentioned in the SAP security note.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/title
- agent/severity
- agent/source
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/sap
- canonical/sap abap
- version/sap abap/75c
- version/sap abap/75d
- version/sap abap/75e
- canonical/sap application interface framework
- version/sap application interface framework/aif_703
- version/sap application interface framework/aifx_702
- canonical/sap basis component 700
- version/sap basis component 700/755
- version/sap basis component 700/756
- canonical/sap s/4hana
- version/sap s/4hana/101