Read the docs
TI-2023-15416 Aliases CVE-2023-32113GHSA-hx63-v72x-x8vx

Information Disclosure vulnerability in SAP GUI for Windows

Priority MEDIUM 43CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

SAP GUI for Windows - version 7.70, 8.0, allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking it into clicking a prepared shortcut file. Depending on the authorizations of the victim, the attacker can read and modify potentially sensitive information after successful exploitation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00527 44th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP GUI for Windowsup to 7.70; 7.70 PL0 – 7.70 PL11; 8.00 PL0 – 8.00 PL1—No fix listedCNA
  • SAP GUI for Windows VendorSAP Affected up to 7.70; 7.70 PL0 – 7.70 PL11; 8.00 PL0 – 8.00 PL1 Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:sap:gui_for_windows:*:*:*:*:*:*:*:*before 7.70VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:-:*:*:*:*:*:*7.70VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level1:*:*:*:*:*:*7.70 patch_level1VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level10:*:*:*:*:*:*7.70 patch_level10VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level11:*:*:*:*:*:*7.70 patch_level11VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level2:*:*:*:*:*:*7.70 patch_level2VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level3:*:*:*:*:*:*7.70 patch_level3VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level4:*:*:*:*:*:*7.70 patch_level4VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level5:*:*:*:*:*:*7.70 patch_level5VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level6:*:*:*:*:*:*7.70 patch_level6VulnerableSAP
  • cpe:2.3:a:sap:gui_for_windows:*:*:*:*:*:*:*:* Versions before 7.70 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:-:*:*:*:*:*:* Versions 7.70 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level1:*:*:*:*:*:* Versions 7.70 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level10:*:*:*:*:*:* Versions 7.70 patch_level10 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level11:*:*:*:*:*:* Versions 7.70 patch_level11 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level2:*:*:*:*:*:* Versions 7.70 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level3:*:*:*:*:*:* Versions 7.70 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level4:*:*:*:*:*:* Versions 7.70 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level5:*:*:*:*:*:* Versions 7.70 patch_level5 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level6:*:*:*:*:*:* Versions 7.70 patch_level6 Vulnerable ·SAP
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level7:*:*:*:*:*:*7.70 patch_level7VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level8:*:*:*:*:*:*7.70 patch_level8VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level9:*:*:*:*:*:*7.70 patch_level9VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:8.0:-:*:*:*:*:*:*8.0VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:8.0:patch_level1:*:*:*:*:*:*8.0 patch_level1VulnerableSAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level7:*:*:*:*:*:* Versions 7.70 patch_level7 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level8:*:*:*:*:*:* Versions 7.70 patch_level8 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level9:*:*:*:*:*:* Versions 7.70 patch_level9 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:8.0:patch_level1:*:*:*:*:*:* Versions 8.0 patch_level1 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32113
  2. 2026-10-03 Alias added: GHSA-hx63-v72x-x8vx

References

Advisory 2

  • TI-2017-04660 SAP GUI 7.2 through 7.5 allows remote attackers to bypass intended security policy… CVSS 3.0CRITICAL 9.8
  • TI-2021-17550 Insufficiently protected credentials in SAP GUI for Windows CVSS 3.1HIGH 7.8
  • TI-2021-09064 Open redirect in SAP GUI for Windows CVSS 3.1MEDIUM 6.1
  • TI-2024-26530 [CVE-2024-39600] Information Disclosure vulnerability in SAP GUI for Windows CVSS 3.1MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences