Vulnerability · Published Jun 13, 2023 · Assigned by sap
CVE-2023-32115SQL Injection in Master Data Synchronization (MDS COMPARE TOOL)
Medium 4.2
In plain English
A medium-severity SQL injection in Master Data Synchronization (MDS COMPARE TOOL) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.2%top 87.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An attacker can exploit MDS COMPARE TOOL and use specially crafted inputs to read and modify database commands, resulting in the retrieval of additional information persisted by the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | Master Data Synchronization (MDS COMPARE TOOL) | SAP_APPL 600SAP_APPL 602SAP_APPL 603SAP_APPL 604SAP_APPL 605SAP_APPL 606SAP_APPL 616 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N