Vulnerability · Published Sep 10, 2024 · Assigned by sap
CVE-2024-45286Missing Authorization check in SAP Production and Revenue Accounting (Tobin interface)
Medium 6.5
In plain English
A medium-severity missing authorization in SAP Production and Revenue Accounting (Tobin interface) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 74.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Production and Revenue Accounting allows unauthorized access that could lead to disclosure of highly sensitive data. There is no impact on integrity or availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Production and Revenue Accounting (Tobin interface) | S4CEXT 106S4CEXT 107S4CEXT 108IS-PRA 605IS-PRA 606IS-PRA 616IS-PRA 617IS-PRA 618 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N