CVE-2023-6542 Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID
An attacker can bypass authorization checks in the SAP Emarsys Android SDK to navigate to arbitrary URLs or deep links within the host application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6542?
CVE-2023-6542 is a high-severity missing authorization vulnerability in SAP_SE SAP EMARSYS SDK ANDROID, published on 12 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker could navigate to arbitrary URL including application deep links on the device.
Weakness: CWE-863
Which versions are affected by CVE-2023-6542?
It affects 1 product.
Products include Sap Emarsys Sdk.
How do I fix CVE-2023-6542?
No fix has been published for CVE-2023-6542 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-6542 being exploited?
There is no known exploitation of CVE-2023-6542 in the wild and no public exploit code.
Sources
Also known as GHSA-v9m4-696p-qh68.