VDB
CVE-2023-0019
CVE-2023-0019
PUBLISHED
CVSS 6.5 MEDIUM
Reported by sap · Published February 14, 2023
In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database. Successful exploitation of this vulnerability can expose user credentials from client-specific tables of the database, leading to high impact on confidentiality.
Risk scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP GRC (Process Control) | V1200, V8100, V1100_700 |
| SAP_SE | SAP GRC (Process Control) | 1200, 8100, 1100_700 |
Timeline
- Feb 13, 2023 CVE Published
- Feb 14, 2023 EPSS Score (30 in total, the first dated here)
- Feb 14, 2023 PoC Published
- May 22, 2026 Coalition ESS Score
- Jun 2, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-0019
vulnetix vdb fixes CVE-2023-0019Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-0019/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart