Log in Start free

Vulnerability · Published Mar 11, 2025 · Assigned by sap

CVE-2025-27432Missing Authorization check in SAP Electronic Invoicing for Brazil (eDocument Cockpit)

Low 2.4

In plain English

A low-severity missing authorization in SAP Electronic Invoicing for Brazil (eDocument Cockpit) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low
Exploit odds (30 days)0.2%top 90.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorized access to each transaction. By executing the specific ABAP method within the ABAP system, an unauthorized attacker could call each transaction and view the inbound delivery details. This vulnerability has a low impact on the confidentiality with no effect on the integrity and the availability of the application.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP Electronic Invoicing for Brazil (eDocument Cockpit) SAP_APPL 617618S4CORE 102103104105106107

Weakness: CWE-862 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References