SAP Authenticator vulnerabilities

2 CVEs affecting SAP Authenticator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-27895, published 2023-03-14.

More from SAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-35290, published 2022-08-10. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted.
• CVE-2023-27895, published 2023-03-14. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently…