CVE-2023-40625: Missing Authorization check in SAP Manage Purchase Contracts App
S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and integrity with no impact on availibility of the system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40625?
The severity of CVE-2023-40625 is medium with a severity value of 5.4.
What is the description of CVE-2023-40625?
CVE-2023-40625 refers to the vulnerability in S4CORE (Manage Purchase Contracts App) versions 102, 103, 104, 105, 106, and 107 that does not perform necessary authorization checks for an authenticated user, allowing potential privilege escalation.
Which software versions are affected by CVE-2023-40625?
S4CORE (Manage Purchase Contracts App) versions 102, 103, 104, 105, 106, and 107 are affected by CVE-2023-40625.
How can an attacker exploit CVE-2023-40625?
An attacker can exploit CVE-2023-40625 by leveraging the lack of necessary authorization checks to perform unintended actions, leading to the escalation of privileges.
Are there any references available for CVE-2023-40625?
Yes, you can find more information about CVE-2023-40625 at the following references: - [SAP Note 3326361](https://me.sap.com/notes/3326361) - [SAP Document](https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html)