Search
Find a vulnerability
Search criteria
2 vulnerabilities found for SAP Group Reporting Data Collection (Enter Package Data) by SAP_SE
CVE-2024-28167 (GCVE-0-2024-28167)
Vulnerability from nvd – Published: 2024-04-09 00:55 – Updated: 2024-08-02 00:48
VLAI
Title
Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data)
Summary
SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| SAP_SE | SAP Group Reporting Data Collection (Enter Package Data) |
Affected:
S4CORE 104
Affected: S4CORE 105 Affected: S4CORE 106 Affected: S4CORE 107 Affected: S4CORE 108 Affected: SAP_GRDC_CLOUD 1.0.0 |
|
| sap_se | sap_group_reporting_data_collection |
Affected:
s4core_104
Affected: s4core_105 Affected: s4core_106 Affected: s4core_107 Affected: s4core_108 Affected: sap_grdc_cloud_1.0.0 cpe:2.3:a:sap_se:sap_group_reporting_data_collection:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:sap_se:sap_group_reporting_data_collection:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sap_group_reporting_data_collection",
"vendor": "sap_se",
"versions": [
{
"status": "affected",
"version": "s4core_104"
},
{
"status": "affected",
"version": "s4core_105"
},
{
"status": "affected",
"version": "s4core_106"
},
{
"status": "affected",
"version": "s4core_107"
},
{
"status": "affected",
"version": "s4core_108"
},
{
"status": "affected",
"version": "sap_grdc_cloud_1.0.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-09T15:19:15.843400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-01T20:35:37.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:48:49.373Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://me.sap.com/notes/3442378"
},
{
"tags": [
"x_transferred"
],
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SAP Group Reporting Data Collection (Enter Package Data)",
"vendor": "SAP_SE",
"versions": [
{
"status": "affected",
"version": "S4CORE 104"
},
{
"status": "affected",
"version": "S4CORE 105"
},
{
"status": "affected",
"version": "S4CORE 106"
},
{
"status": "affected",
"version": "S4CORE 107"
},
{
"status": "affected",
"version": "S4CORE 108"
},
{
"status": "affected",
"version": "SAP_GRDC_CLOUD 1.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSAP Group Reporting Data Collection\u00a0does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.\u003c/p\u003e"
}
],
"value": "SAP Group Reporting Data Collection\u00a0does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "eng",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T00:55:46.326Z",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"url": "https://me.sap.com/notes/3442378"
},
{
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2024-28167",
"datePublished": "2024-04-09T00:55:46.326Z",
"dateReserved": "2024-03-06T06:12:27.005Z",
"dateUpdated": "2024-08-02T00:48:49.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-28167 (GCVE-0-2024-28167)
Vulnerability from cvelistv5 – Published: 2024-04-09 00:55 – Updated: 2024-08-02 00:48
VLAI
Title
Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data)
Summary
SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| SAP_SE | SAP Group Reporting Data Collection (Enter Package Data) |
Affected:
S4CORE 104
Affected: S4CORE 105 Affected: S4CORE 106 Affected: S4CORE 107 Affected: S4CORE 108 Affected: SAP_GRDC_CLOUD 1.0.0 |
|
| sap_se | sap_group_reporting_data_collection |
Affected:
s4core_104
Affected: s4core_105 Affected: s4core_106 Affected: s4core_107 Affected: s4core_108 Affected: sap_grdc_cloud_1.0.0 cpe:2.3:a:sap_se:sap_group_reporting_data_collection:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:sap_se:sap_group_reporting_data_collection:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sap_group_reporting_data_collection",
"vendor": "sap_se",
"versions": [
{
"status": "affected",
"version": "s4core_104"
},
{
"status": "affected",
"version": "s4core_105"
},
{
"status": "affected",
"version": "s4core_106"
},
{
"status": "affected",
"version": "s4core_107"
},
{
"status": "affected",
"version": "s4core_108"
},
{
"status": "affected",
"version": "sap_grdc_cloud_1.0.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-09T15:19:15.843400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-01T20:35:37.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:48:49.373Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://me.sap.com/notes/3442378"
},
{
"tags": [
"x_transferred"
],
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SAP Group Reporting Data Collection (Enter Package Data)",
"vendor": "SAP_SE",
"versions": [
{
"status": "affected",
"version": "S4CORE 104"
},
{
"status": "affected",
"version": "S4CORE 105"
},
{
"status": "affected",
"version": "S4CORE 106"
},
{
"status": "affected",
"version": "S4CORE 107"
},
{
"status": "affected",
"version": "S4CORE 108"
},
{
"status": "affected",
"version": "SAP_GRDC_CLOUD 1.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSAP Group Reporting Data Collection\u00a0does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.\u003c/p\u003e"
}
],
"value": "SAP Group Reporting Data Collection\u00a0does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "eng",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T00:55:46.326Z",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"url": "https://me.sap.com/notes/3442378"
},
{
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2024-28167",
"datePublished": "2024-04-09T00:55:46.326Z",
"dateReserved": "2024-03-06T06:12:27.005Z",
"dateUpdated": "2024-08-02T00:48:49.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}