Lucene search

SapCVELIST:CVE-2023-42475

HistoryOct 10, 2023 - 1:37 a.m.

CVE-2023-42475 Information Disclosure Vulnerability in Statutory Reporting

2023-10-1001:37:36

CWE-200

sap

www.cve.org

cve-2023-42475

information disclosure

vulnerability

statutory reporting

file storage

low privileged attacker

server files

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

JSON

The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP S/4HANA Core",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "S4CORE 102"
      },
      {
        "status": "affected",
        "version": "S4CORE 103"
      },
      {
        "status": "affected",
        "version": "S4CORE 104"
      },
      {
        "status": "affected",
        "version": "S4CORE 105"
      },
      {
        "status": "affected",
        "version": "S4CORE 106"
      },
      {
        "status": "affected",
        "version": "SAPSCORE 128"
      }
    ]
  }
]

References

me.sap.com/notes/3222121

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

JSON

Related for CVELIST:CVE-2023-42475