description: SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable.
problem types: Missing Authorization
affected:
{
product: SAP NetWeaver AS ABAP (SAP Landscape Transformation)
vendor: SAP SE
versions:
status: affected, version: < 2011_1_620
status: affected, version: < 2011_1_640
status: affected, version: < 2011_1_700
status: affected, version: < 2011_1_710
status: affected, version: < 2011_1_730
status: affected, version: < 2011_1_731
status: affected, version: < 2011_1_752
status: affected, version: < 2020
}
{
product: SAP S4 HANA (SAP Landscape Transformation)
vendor: SAP SE
versions:
status: affected, version: < 101
status: affected, version: < 102
status: affected, version: < 103
status: affected, version: < 104
status: affected, version: < 105
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H
version: 3.0
]