description: Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) does not execute the required authorization checks for an authenticated user, allowing an attacker to view and tamper with certain restricted data leading to Missing Authorization Check.
problem types: Missing Authorization Check
affected:
{
product: SAP ERP (Statutory Reporting for Insurance Companies)
vendor: SAP SE
versions:
status: affected, version: < EA-FINSERV 600
status: affected, version: < 603
status: affected, version: < 604
status: affected, version: < 605
status: affected, version: < 606
status: affected, version: < 616
status: affected, version: < 617
status: affected, version: < 618
status: affected, version: < 800S4CORE 101
status: affected, version: < 102
status: affected, version: < 103
status: affected, version: < 104
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
version: 3.0
]