Vulnerability · Published Apr 9, 2024 · Assigned by sap
CVE-2024-28167Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data)
Medium 6.5
In plain English
A medium-severity missing authorization in SAP Group Reporting Data Collection (Enter Package Data) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Group Reporting Data Collection (Enter Package Data) | S4CORE 104S4CORE 105S4CORE 106S4CORE 107S4CORE 108SAP_GRDC_CLOUD 1.0.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N