description: Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could completely compromise confidentiality, integrity, and availability of the system.
problem types: Improper Input Sanitization
affected:
{
product: SAP S/4HANA
vendor: SAP SE
versions:
status: affected, version: < 1511
status: affected, version: < 1610
status: affected, version: < 1709
status: affected, version: < 1809
status: affected, version: < 1909
status: affected, version: < 2020
status: affected, version: < 2021
}
{
product: SAP LT Replication Server
vendor: SAP SE
versions:
status: affected, version: < 2.0
status: affected, version: < 3.0
}
{
product: SAP LTRS for S/4HANA
vendor: SAP SE
versions:
status: affected, version: < 1.0
}
{
product: SAP Test Data Migration Server
vendor: SAP SE
versions:
status: affected, version: < 4.0
}
{
product: SAP Landscape Transformation
vendor: SAP SE
versions:
status: affected, version: < 2.0
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.0
]