description: SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.
problem types: Code Injection
affected:
{
product: SAP AS ABAP(DMIS)
vendor: SAP SE
versions:
status: affected, version: < 2011_1_620
status: affected, version: < 2011_1_640
status: affected, version: < 2011_1_700
status: affected, version: < 2011_1_710
status: affected, version: < 2011_1_730
status: affected, version: < 2011_1_731
status: affected, version: < 2011_1_752
status: affected, version: < 2020
}
{
product: SAP S4 HANA(DMIS)
vendor: SAP SE
versions:
status: affected, version: < 101
status: affected, version: < 102
status: affected, version: < 103
status: affected, version: < 104
status: affected, version: < 105
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.0
]