CVE-2023-6542 HIGH

CVE-2023-6542: Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID

Vendor Sap_Se

Product SAP EMARSYS SDK ANDROID

Weakness CWE-863 · Incorrect authorization

Published December 12, 2023

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker could navigate to arbitrary URL including application deep links on the device.

Key dates

02Disclosure timeline

December 12, 2023 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-6542 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html

Related vulnerabilities

04Related CVE

CVE-2026-47236 Solidtime team page exposes pending invitation and member emails to employees who lack invitations:view/members:view permission CVE-2025-30162 East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers CVE-2021-41528 Improper authorization related to Import / Export interfaces on RISC Platform CVE-2026-26963 Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled CVE-2023-25924 IBM Security Key Lifecycle Manager improper authorization