Cyber Resilience

CVE-2023-29109

Medium

Published: 11 April 2023

Published
11 April 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS Score 0.0040 61.4th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-29109 is a medium-severity Improper Neutralization of Formula Elements in a CSV File (CWE-1236) vulnerability in Sap Abap Platform. Its CVSS base score is 4.4 (Medium).

Operationally, ranked in the top 38.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the…

more

Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application.

CWE(s)
CWE-1236

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

sap
abap platform
75c, 75d, 75e
sap
application interface framework
aif_703, aifx_702
sap
basis
755, 756
sap
s4core
101

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References