description: SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check.
problem types: Missing Authorization Check
affected:
{
product: SAP ERP
vendor: SAP SE
versions:
status: affected, version: < 600
status: affected, version: < 602
status: affected, version: < 603
status: affected, version: < 604
status: affected, version: < 605
status: affected, version: < 606
status: affected, version: < 616
status: affected, version: < 617
status: affected, version: < 618
}
{
product: SAP S/4 HANA
vendor: SAP SE
versions:
status: affected, version: < 100
status: affected, version: < 101
status: affected, version: < 102
status: affected, version: < 103
status: affected, version: < 104
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.0
]