CVE-2023-0019 Missing authorization in SAP GRC (Process Control)
An authenticated attacker with minimal privileges can access confidential database data, including user credentials, due to missing authorization checks in SAP GRC.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0019?
CVE-2023-0019 is a medium-severity missing authorization vulnerability in SAP_SE SAP GRC (Process Control), published on 14 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality.
Weakness: CWE-862
Which versions are affected by CVE-2023-0019?
It affects 1 product.
Products include Sap Grc Process Control.
How do I fix CVE-2023-0019?
No fix has been published for CVE-2023-0019 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-0019 being exploited?
There is no known exploitation of CVE-2023-0019 in the wild and no public exploit code.
Sources
Also known as GHSA-4887-8mjq-x63j.