CVE-2023-27895CWE-267

Information Disclosure vulnerability in SAP Authenticator for Android

Medium · published March 14, 2023

CVSS v3.1
6.1
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful exploitation, an attacker can read some sensitive information but cannot modify and delete the data.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00405 · 33.7th percentile
Weakness
CWE-267 · Privilege Defined With Unsafe Actions
Published
2023-03-14T05:08Z
EPSS history
Timeline
  • 14 MAR 05:08Z
    Information Disclosure vulnerability in SAP Authenticator for Android
    cvelistv5