SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful exploitation, an attacker can read some sensitive information but cannot modify and delete the data.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3302710 | Permissions Required |
| https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html | Vendor Advisory |
Configurations
History
11 Apr 2023, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful exploitation, an attacker can read some sensitive information but cannot modify and delete the data. |
20 Mar 2023, 15:48
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sap
Sap authenticator |
|
| CPE | cpe:2.3:a:sap:authenticator:1.3.0:*:*:*:*:android:*:* | |
| References | (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory | |
| References | (MISC) https://launchpad.support.sap.com/#/notes/3302710 - Permissions Required | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
14 Mar 2023, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-14 06:15
Updated : 2023-12-10 14:48
NVD link : CVE-2023-27895
Mitre link : CVE-2023-27895
CVE.ORG link : CVE-2023-27895
JSON object : View
Products Affected
sap
- authenticator
CWE
CWE-267
Privilege Defined With Unsafe Actions