SARA / Free Tools / CVE / CVE-2023-29109

CVE-2023-29109 — The SAP Application Interface Framework (Message Dashboard) - versions AIF 703,

The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip

CVSS
4.4 MEDIUM
EPSS
0.42% (top 38.10%)
CWE
CWE-1236
Published
2023-04-11T02:58:49.648Z
Last modified
2025-02-07T16:52:14.949Z
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

01What is this vulnerability?

The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a…

02Affected products

VendorProductVersions
SAPApplication Interface Framework (Message Dashboard)AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, SAP_BASIS 756, SAP_ABA 75C, SAP_ABA 75D, SAP_ABA 75E

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

09References

Want this in your SOAR or SIEM?
SARA's API returns EPSS, CVSS, KEV, and an analyst-grade summary in one call.
Read the API reference →
EPSS detail → Search KEV → Ask SARA →