description: The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection.
problem types: SQL Injection
affected:
{
product: SAP Master Data Governance (S4CORE)
vendor: SAP SE
versions:
status: affected, version: < 101
}
{
product: SAP Master Data Governance (S4FND)
vendor: SAP SE
versions:
status: affected, version: < 102
status: affected, version: < 103
status: affected, version: < 104
}
{
product: SAP Master Data Governance (SAP_BS_FND)
vendor: SAP SE
versions:
status: affected, version: < 748
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.0
]