CVE-2023-42473

S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the application.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3219846	Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:s\/4hana:106:*:*:*:*:*:*:*

History

11 Oct 2023, 19:10

Type	Values Removed	Values Added
References	~~(MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html -~~	(MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory
References	~~(MISC) https://me.sap.com/notes/3219846 -~~	(MISC) https://me.sap.com/notes/3219846 - Permissions Required
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.4
First Time		Sap Sap s\/4hana
CPE		cpe:2.3:a:sap:s\/4hana:106:::::::*

10 Oct 2023, 02:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-10 02:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-42473

Mitre link : CVE-2023-42473

CVE.ORG link : CVE-2023-42473

JSON object : View

Products Affected

sap

s\/4hana

CWE

CWE-862

Missing Authorization

{"id": "CVE-2023-42473", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2023-10-10T02:15:10.860", "references": [{"url": "https://me.sap.com/notes/3219846", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "S/4HANA Manage (Withholding Tax Items) - version 106,\u00a0does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the application.\n\n"}, {"lang": "es", "value": "S/4HANA Manage (Art\u00edculos de retenci\u00f3n de impuestos): versi\u00f3n 106, no realiza las verificaciones de autorizaci\u00f3n necesarias para un usuario autenticado, lo que resulta en una escalada de privilegios que tiene un impacto bajo en la confidencialidad e integridad de la aplicaci\u00f3n."}], "lastModified": "2023-10-11T19:10:40.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:s\\/4hana:106:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0023602-B509-4B20-9B29-20EEE88E1692"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}