title: HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)
description: SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields
problem types: CWE-23: Relative Path Traversal
affected:
{
defaultStatus: unaffected
product: CRM (WebClient UI)
vendor: SAP
versions:
status: affected, version: S4FND 102
status: affected, version: S4FND 103
status: affected, version: S4FND 104
status: affected, version: S4FND 105
status: affected, version: S4FND 106
status: affected, version: S4FND 107
status: affected, version: WEBCUIF 700
status: affected, version: WEBCUIF 701
status: affected, version: WEBCUIF 731
status: affected, version: WEBCUIF 730
status: affected, version: WEBCUIF 746
status: affected, version: WEBCUIF 747
status: affected, version: WEBCUIF 748
status: affected, version: WEBCUIF 800
status: affected, version: WEBCUIF 801
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL