CVE-2023-29109: SAP Abap Platform

Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days.

The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application.

Affected products

• SAP Abap Platform: version 75c only; version 75d only; version 75e only
• SAP Application Interface Framework: version aif_703 only; version aifx_702 only
• SAP Basis: version 755 only; version 756 only
• SAP s4core: version 101 only

Published 2023-04-11. Last modified 2026-06-17.