« Volver al listado

CVE-2023-49584

Estado: ModificadaMedia (4.3)—

SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Fiori Launchpad

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-49584",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-49584",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-24T10:27:15.975335Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Fiori Launchpad",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_UI 750"
            },
            {
              "status": "affected",
              "version": "SAP_UI 754"
            },
            {
              "status": "affected",
              "version": "SAP_UI 755"
            },
            {
              "status": "affected",
              "version": "SAP_UI 756"
            },
            {
              "status": "affected",
              "version": "SAP_UI 757"
            },
            {
              "status": "affected",
              "version": "SAP_UI 758"
            },
            {
              "status": "affected",
              "version": "UI_700 200"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 793"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-12-12T02:15:08.147",
  "references": [
    {
      "url": "https://me.sap.com/notes/3406786",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://me.sap.com/notes/3406786",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application.\n\n"
    },
    {
      "lang": "es",
      "value": "Plataforma de lanzamiento de SAP Fiori: versiones SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, permite a un atacante utilizar el verbo HTTP POST en un servicio de solo lectura, lo que provoca un bajo impacto en la confidencialidad de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T06:36:12.233",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:fiori_launchpad:200:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6338D9D-D995-44B5-90A0-0C8DA9E704D0"
            },
            {
              "criteria": "cpe:2.3:a:sap:fiori_launchpad:700:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50831B74-875B-4488-A7A4-A3CDB7DD157D"
            },
            {
              "criteria": "cpe:2.3:a:sap:fiori_launchpad:750:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6670362E-7FA7-4AD4-A988-DE64BFE39EDF"
            },
            {
              "criteria": "cpe:2.3:a:sap:fiori_launchpad:754:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3799BA89-00B9-4D4C-8364-B3B233396F28"
            },
            {
              "criteria": "cpe:2.3:a:sap:fiori_launchpad:755:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFA4D1AE-4823-4717-BD4F-8BA6AB332C3D"
            },
            {
              "criteria": "cpe:2.3:a:sap:fiori_launchpad:756:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66917A83-50B5-4EF4-818F-8EB17DDCA057"
            },
            {
              "criteria": "cpe:2.3:a:sap:fiori_launchpad:757:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BDB20DB-D6C9-4848-AA4A-5771881CBE96"
            },
            {
              "criteria": "cpe:2.3:a:sap:fiori_launchpad:758:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91E3FE8E-EC2A-4CB6-A46F-A40CF6EDA819"
            },
            {
              "criteria": "cpe:2.3:a:sap:fiori_launchpad:793:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCB27816-94A5-4F74-B1E0-B86B142404DC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}