Riskcovery

CVE-2023-40625

Missing Authorization check in SAP Manage Purchase Contracts App

State
Published
Severity
5.4 Medium
Published
Sep 12, 2023
Updated
Sep 25, 2024
Reserved
Aug 17, 2023

Read the record on cve.org

Description

S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and integrity with no impact on availibility of the system.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nsap

Weaknesses

Affected Products

ProductVersions
SAP Manage Purchase Contracts AppSAP_SE
  • S4CORE 102Affected
  • S4CORE 103Affected
  • S4CORE 104Affected
  • S4CORE 105Affected
  • S4CORE 106Affected
  • S4CORE 107Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.