5.3

CVE-2023-41368

The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call.

Data is provided by the National Vulnerability Database (NVD)
SAP ≫ S/4 Hana Version102
SAP ≫ S/4 Hana Version103
SAP ≫ S/4 Hana Version104
SAP ≫ S/4 Hana Version105
SAP ≫ S/4 Hana Version106
SAP ≫ S/4 Hana Version107
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.15% 0.37
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
cna@sap.com 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://me.sap.com/notes/3355675
Permissions Required