title: Missing Authorization check in SAP Master Data Governance Material
description: SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read some sensitive information but no impact to integrity and availability.
problem types: CWE-862: Missing Authorization
affected:
{
defaultStatus: unaffected
product: SAP Master Data Governance Material
vendor: SAP_SE
versions:
status: affected, version: 618
status: affected, version: 619
status: affected, version: 620
status: affected, version: 621
status: affected, version: 622
status: affected, version: 800
status: affected, version: 801
status: affected, version: 802
status: affected, version: 803
status: affected, version: 804
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL