CVE-2023-0019 is a critical vulnerability affecting SAP GRC (Process Control) versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, and GRCPINW V1200_750. An authenticated attacker with minimal privileges can exploit a remote-enabled function module to access all confidential data within the database. This vulnerability has a CVSS score of 6.5 (Medium), indicating a network-based attack with low complexity, requiring low privileges, and resulting in high confidentiality impact by exposing user credentials. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
v1100_700CPE matchmatch criteria | cpe:2.3:a:sap:grc_process_control:v1100_700:*:*:*:*:*:*:* | ||
v1100_731CPE matchmatch criteria | cpe:2.3:a:sap:grc_process_control:v1100_731:*:*:*:*:*:*:* | ||
v1200CPE matchmatch criteria | cpe:2.3:a:sap:grc_process_control:v1200:*:*:*:*:*:*:* | ||
v1200_750CPE matchmatch criteria | cpe:2.3:a:sap:grc_process_control:v1200_750:*:*:*:*:*:*:* | ||
v8100CPE matchmatch criteria | cpe:2.3:a:sap:grc_process_control:v8100:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.