Vulnerability · Published Sep 12, 2023 · Assigned by sap

CVE-2023-40625Missing Authorization check in SAP Manage Purchase Contracts App

Medium 5.4

In plain English

A medium-severity missing authorization in SAP Manage Purchase Contracts App from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 69.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and integrity with no impact on availibility of the system.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP Manage Purchase Contracts App	S4CORE 102S4CORE 103S4CORE 104S4CORE 105S4CORE 106S4CORE 107

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References