Read the docs
TI-2023-27078 Aliases CVE-2023-49580GHSA-qgv8-w8cv-37pw

Information disclosure in SAP GUI for Windows and SAP GUI for Java

Priority LOW 33CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to create Layout configurations of the ABAP List Viewer and with this causing a mild impact on integrity and availability, e.g. also increasing the response times of the AS ABAP.

Why it matters now

EPSS 0.00478 41st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP GUI for Windows and SAP GUI for JavaSAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; SAP_BASIS 758—No fix listedCNA
  • SAP GUI for Windows and SAP GUI for Java VendorSAP Affected SAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; SAP_BASIS 758 Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:sap:graphical_user_interface:sap_basis_755:*:*:*:*:java:*:*sap_basis_755VulnerableSAP
cpe:2.3:a:sap:graphical_user_interface:sap_basis_755:*:*:*:*:windows:*:*sap_basis_755VulnerableSAP
cpe:2.3:a:sap:graphical_user_interface:sap_basis_756:*:*:*:*:java:*:*sap_basis_756VulnerableSAP
cpe:2.3:a:sap:graphical_user_interface:sap_basis_756:*:*:*:*:windows:*:*sap_basis_756VulnerableSAP
cpe:2.3:a:sap:graphical_user_interface:sap_basis_757:*:*:*:*:java:*:*sap_basis_757VulnerableSAP
cpe:2.3:a:sap:graphical_user_interface:sap_basis_757:*:*:*:*:windows:*:*sap_basis_757VulnerableSAP
cpe:2.3:a:sap:graphical_user_interface:sap_basis_758:*:*:*:*:java:*:*sap_basis_758VulnerableSAP
cpe:2.3:a:sap:graphical_user_interface:sap_basis_758:*:*:*:*:windows:*:*sap_basis_758VulnerableSAP
  • cpe:2.3:a:sap:graphical_user_interface:sap_basis_755:*:*:*:*:java:*:* Versions sap_basis_755 Vulnerable ·SAP
  • cpe:2.3:a:sap:graphical_user_interface:sap_basis_755:*:*:*:*:windows:*:* Versions sap_basis_755 Vulnerable ·SAP
  • cpe:2.3:a:sap:graphical_user_interface:sap_basis_756:*:*:*:*:java:*:* Versions sap_basis_756 Vulnerable ·SAP
  • cpe:2.3:a:sap:graphical_user_interface:sap_basis_756:*:*:*:*:windows:*:* Versions sap_basis_756 Vulnerable ·SAP
  • cpe:2.3:a:sap:graphical_user_interface:sap_basis_757:*:*:*:*:java:*:* Versions sap_basis_757 Vulnerable ·SAP
  • cpe:2.3:a:sap:graphical_user_interface:sap_basis_757:*:*:*:*:windows:*:* Versions sap_basis_757 Vulnerable ·SAP
  • cpe:2.3:a:sap:graphical_user_interface:sap_basis_758:*:*:*:*:java:*:* Versions sap_basis_758 Vulnerable ·SAP
  • cpe:2.3:a:sap:graphical_user_interface:sap_basis_758:*:*:*:*:windows:*:* Versions sap_basis_758 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49580
  2. 2026-10-03 Alias added: GHSA-qgv8-w8cv-37pw

References

Advisory 2

  • TI-2011-04431 Multiple untrusted search path vulnerabilities in (1) SAPGui.exe and (2) BExAnalyzer.exe… CVSS 2.0MEDIUM 6.9
  • TI-2021-04546 SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences