description: SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, SAPSCORE - 125, S4CORE, 100, 101, 102, 103, 104, 105, allows a registered attacker to invoke certain functions that would otherwise be restricted to specific users. These functions are normally exposed over the network and once exploited the attacker may be able to view and modify financial accounting data that only a specific user should have access to.
problem types: CWE-862: Missing Authorization
affected:
{
product: SAP ERP Financial Accounting (RFOPENPOSTING_FR)
vendor: SAP SE
versions:
status: affected, version: < SAP_APPL - 600
status: affected, version: < 602
status: affected, version: < 603
status: affected, version: < 604
status: affected, version: < 605
status: affected, version: < 606
status: affected, version: < 616
status: affected, version: < SAP_FIN - 617
status: affected, version: < 618
status: affected, version: < 700
status: affected, version: < 720
status: affected, version: < 730
status: affected, version: < SAPSCORE - 125
status: affected, version: < S4CORE
status: affected, version: < 100
status: affected, version: < 101
status: affected, version: < 102
status: affected, version: < 103
status: affected, version: < 104
status: affected, version: < 105
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.0
]