Lucene search

SapCVELIST:CVE-2023-1903

HistoryApr 11, 2023 - 2:31 a.m.

CVE-2023-1903 Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0)

2023-04-1102:31:13

CWE-862

sap

www.cve.org

sap

hcm

fiori

forms

authorization check

vulnerability

restricted data

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

29.6%

JSON

SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header data.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "HCM Fiori App My Forms (Fiori 2.0)",
    "vendor": "SAP",
    "versions": [
      {
        "status": "affected",
        "version": "605"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/3301457

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

29.6%

JSON

Related for CVELIST:CVE-2023-1903