CVE-2023-29109: Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)

Published Apr 11, 2023

Updated

The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAPBASIS 755, 756, SAPABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application.

Affected Software

8 affected components

SAP ABAP Platform=75c

SAP ABAP Platform=75d

SAP ABAP Platform=75e

SAP Application Interface Framework=aif_703

SAP Application Interface Framework=aifx_702

SAP BASIS=755

SAP BASIS=756

SAP S4CORE=101

Event History

Apr 11, 2023

CVE Published

via MITRE·02:58 AM

Data Sourced

via MITRE·02:58 AM

DescriptionSeverity

Frequently Asked Questions

What is the vulnerability ID of this SAP vulnerability?

The vulnerability ID of this SAP vulnerability is CVE-2023-29109.

What is the severity of CVE-2023-29109?

The severity of CVE-2023-29109 is medium (4.6).

What is the affected software for CVE-2023-29109?

The affected software for CVE-2023-29109 includes SAP ABAP Platform versions 75C, 75D, and 75E, SAP Application Interface Framework versions AIF 703 and AIFX 702, SAP Basis versions 755 and 756, and Sap S4core version 101.

What is the impact of CVE-2023-29109?

CVE-2023-29109 allows an authorized attacker to inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints.

How can I mitigate the vulnerability CVE-2023-29109?

To mitigate CVE-2023-29109, apply the security patches provided by SAP and follow the recommendations mentioned in the SAP security note.