CVE-2023-32112

LOW

SAP S4CORE and Vendor Master Hierarchy - Authenticated Missing Authorization

Title source: llm
STIX 2.1

Description

Vendor Master Hierarchy - versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618, S4CORE 100, does not perform necessary authorization checks for an authenticated user to access some of its function. This could lead to modification of data impacting the integrity of the system.

References (2)

Core 2

Scores

CVSS v3 2.8
EPSS 0.0011
EPSS Percentile 28.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (11)
sap/s4core 100
sap/vendor_master_hierarchy sap_appl_500
sap/vendor_master_hierarchy sap_appl_600
sap/vendor_master_hierarchy sap_appl_602
sap/vendor_master_hierarchy sap_appl_603
sap/vendor_master_hierarchy sap_appl_604
sap/vendor_master_hierarchy sap_appl_605
sap/vendor_master_hierarchy sap_appl_606
sap/vendor_master_hierarchy sap_appl_616
sap/vendor_master_hierarchy sap_appl_617
... and 1 more
Published May 09, 2023
Tracked Since Feb 18, 2026