CVE-2023-49580: Information disclosure in SAP GUI for Windows and SAP GUI for Java
Vulnerability summary
CVE-2023-49580 is a high (CVSS 7.3) vulnerability in sap_se sap gui for windows and sap gui for java. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.2% of scored vulnerabilities.
Timeline
- 12-12-2023PublishedVulnerability first disclosed.
- 28-09-2024Last modifiedVulnerability information updated.
Description
SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to create Layout configurations of the ABAP List Viewer and with this causing a mild impact on integrity and availability, e.g. also increasing the response times of the AS ABAP.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.48% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap1 product
- graphical_user_interfacesap_basis_755 | sap_basis_756 | sap_basis_757 | sap_basis_758
Sap_se1 product
- sap gui for windows and sap gui for javaSAP_BASIS 755 | SAP_BASIS 756 | SAP_BASIS 757 | SAP_BASIS 758
2 vendors · 2 products