CVE-2023-27897 json
Code Injection vulnerability in SAP CRM
published 2023-04-11 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-31631
- cvss
- 6.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can can have limited impact on confidentiality and integrity of non-critical user or application data and application availability.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L |
| NVD | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Affected products
- SAP CRM
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
sap.com
/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
vendor-advisory
-
launchpad.support.sap.com
/#/notes/3309056
permissions-required
Sources
- CVE List CVE-2023-27897
- NVD CVE-2023-27897
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.