Vulnerability · Published Feb 14, 2023 · Assigned by sap

CVE-2023-24528

Medium 6.5

In plain English

A medium-severity missing authorization in Fiori apps 1.0 for travel management in SAP ERP (My Travel Requests) from SAP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 57.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data. This endpoint is normally exposed over the network and successful exploitation can lead to exposure of data like travel documents.

Affected products (as reported)

Vendor	Product	Versions
SAP	Fiori apps 1.0 for travel management in SAP ERP (My Travel Requests)	600

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References