Riskcovery

CVE-2023-0019

State
Published
Severity
6.5 Medium
Published
Feb 14, 2023
Updated
Mar 20, 2025
Reserved
Dec 20, 2022

Read the record on cve.org

Description

In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsap

Weaknesses

Affected Products

ProductVersions
SAP GRC (Process Control)SAP_SE
  • V1200Affected
  • V8100Affected
  • V1100_700Affected
  • V1100_731Affected
  • V1200_750Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.