Lucene search

[email protected]CVE-2023-42475

HistoryOct 10, 2023 - 2:15 a.m.

CVE-2023-42475

2023-10-1002:15:11

CWE-200

[email protected]

web.nvd.nist.gov

cve-2023-42475

statutory reporting

vulnerable file storage

server files

information security

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.

Affected configurations

NVD

Node

saps\/4hanaMatch102

saps\/4hanaMatch103

saps\/4hanaMatch104

saps\/4hanaMatch105

saps\/4hanaMatch106

saps\/4hanaMatch128

CPENameOperatorVersion
sap:s\/4hanasap s/4hanaeq102
sap:s\/4hanasap s/4hanaeq103
sap:s\/4hanasap s/4hanaeq104
sap:s\/4hanasap s/4hanaeq105
sap:s\/4hanasap s/4hanaeq106
sap:s\/4hanasap s/4hanaeq128

CPE	Name	Operator	Version
sap:s\/4hana	sap s/4hana	eq	102
sap:s\/4hana	sap s/4hana	eq	103
sap:s\/4hana	sap s/4hana	eq	104
sap:s\/4hana	sap s/4hana	eq	105
sap:s\/4hana	sap s/4hana	eq	106
sap:s\/4hana	sap s/4hana	eq	128

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP S/4HANA Core",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "S4CORE 102"
      },
      {
        "status": "affected",
        "version": "S4CORE 103"
      },
      {
        "status": "affected",
        "version": "S4CORE 104"
      },
      {
        "status": "affected",
        "version": "S4CORE 105"
      },
      {
        "status": "affected",
        "version": "S4CORE 106"
      },
      {
        "status": "affected",
        "version": "SAPSCORE 128"
      }
    ]
  }
]

References

me.sap.com/notes/3222121

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

Related for CVE-2023-42475

nvd1 prion1 cvelist1