CVE-2023-6542: SAP Emarsys SDK

High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker could navigate to arbitrary URL including application deep links on the device.

Affected products

• SAP Emarsys SDK: version 3.6.2 only

Published 2023-12-12. Last modified 2026-06-17.