Vulnerability · Published Mar 14, 2023 · Assigned by sap

CVE-2023-27895Information Disclosure vulnerability in SAP Authenticator for Android

Medium 6.1

In plain English

A medium-severity security flaw in Authenticator for Android from SAP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.4%top 65.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful exploitation, an attacker can read some sensitive information but cannot modify and delete the data.

Affected products (as reported)

Vendor	Product	Versions
SAP	Authenticator for Android	1.3.0

Weakness: CWE-267 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References