← Back

CVE-2023-41368

nvd nist
Published: Sep 12, 2023Modified: Nov 21, 2024

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call.

Affected (6)

Products: Sap: S/4 Hana
Sap
1 product
S/4 Hana
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Sap
S/4 Hana
Version 102
S/4 Hana
Version 103
S/4 Hana
Version 104
S/4 Hana
Version 105
S/4 Hana
Version 106
S/4 Hana
Version 107

Related CWEs

CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (4)

Source: cna@sap.com
Permissions Required
Source: cna@sap.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions Required
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.