CVE-2023-49584 Client-Side Desynchronization vulnerability in SAP Fiori Launchpad

Medium 4.3 Published 12 Dec 2023 Updated 24 May 2025

An attacker can exploit HTTP verb POST on read-only services to cause low impact on confidentiality in SAP Fiori Launchpad.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-49584?

CVE-2023-49584 is a medium-severity vulnerability in SAP_SE SAP Fiori Launchpad, published on 12 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application.

Weakness: CWE-444

Which versions are affected by CVE-2023-49584?

It affects 1 product.

Products include Sap Fiori Launchpad.

How do I fix CVE-2023-49584?

No fix has been published for CVE-2023-49584 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-49584 being exploited?

There is no known exploitation of CVE-2023-49584 in the wild and no public exploit code.

Sources

Also known as GHSA-78v6-g7vr-73hg.