TI-2023-13551 Aliases CVE-2023-29109 GHSA-c778-h25h-v8vc

Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)

LOW 21CWE-1236Published 2023-04-11 · Updated 2025-02-07

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00324 25th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	Application Interface Framework (Message Dashboard)	AIF 703; AIFX 702; S4CORE 101; SAP_BASIS 755; SAP_BASIS 756; SAP_ABA 75C; SAP_ABA 75D; SAP_ABA 75E	—	No fix listed	CNA

Application Interface Framework (Message Dashboard) VendorSAP Affected AIF 703; AIFX 702; S4CORE 101; SAP_BASIS 755; SAP_BASIS 756; SAP_ABA 75C; SAP_ABA 75D; SAP_ABA 75E Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:abap_platform:75c:::::::*	75c	Vulnerable	SAP
cpe:2.3:a:sap:abap_platform:75d:::::::*	75d	Vulnerable	SAP
cpe:2.3:a:sap:abap_platform:75e:::::::*	75e	Vulnerable	SAP
cpe:2.3:a:sap:application_interface_framework:aif_703:::::::*	aif_703	Vulnerable	SAP
cpe:2.3:a:sap:application_interface_framework:aifx_702:::::::*	aifx_702	Vulnerable	SAP
cpe:2.3:a:sap:basis:755:::::::*	755	Vulnerable	SAP
cpe:2.3:a:sap:basis:756:::::::*	756	Vulnerable	SAP
cpe:2.3:a:sap:s4core:101:::::::*	101	Vulnerable	SAP

cpe:2.3:a:sap:abap_platform:75c:*:*:*:*:*:*:* Versions 75c Vulnerable ·SAP
cpe:2.3:a:sap:abap_platform:75d:*:*:*:*:*:*:* Versions 75d Vulnerable ·SAP
cpe:2.3:a:sap:abap_platform:75e:*:*:*:*:*:*:* Versions 75e Vulnerable ·SAP
cpe:2.3:a:sap:application_interface_framework:aif_703:*:*:*:*:*:*:* Versions aif_703 Vulnerable ·SAP
cpe:2.3:a:sap:application_interface_framework:aifx_702:*:*:*:*:*:*:* Versions aifx_702 Vulnerable ·SAP
cpe:2.3:a:sap:basis:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
cpe:2.3:a:sap:basis:756:*:*:*:*:*:*:* Versions 756 Vulnerable ·SAP
cpe:2.3:a:sap:s4core:101:*:*:*:*:*:*:* Versions 101 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-29109
2026-10-03 Alias added: GHSA-c778-h25h-v8vc

References

Advisory 1

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Other 1

https://launchpad.support.sap.com/#/notes/3115598

TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
TI-2024-14732 Code Injection vulnerability in SAP ABA (Application Basis) CVSS 3.1CRITICAL 9.1
TI-2020-05148 SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730… CVSS 3.1HIGH 8.8
TI-2020-05170 Code injection in SAP NetWeaver and ABAP Platform CVSS 3.1HIGH 7.2
TI-2023-10915 SQL Injection vulnerability in SAP ABAP Platform CVSS 3.1MEDIUM 6.8
TI-2020-05039 Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS… CVSS 3.1MEDIUM 5.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences