description: The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Management), S4CORE versions- 100, 101, 102, 103, 104; does not have any authorization check to it due to which an attacker without an authorization group can maintain any company certificate, leading to Missing Authorization Check.
problem types: Missing Authorization Check
affected:
{
product: SAP ERP (EAPPGLO)
vendor: SAP SE
versions:
status: affected, version: < 607
}
{
product: SAP ERP (SAP_FIN)
vendor: SAP SE
versions:
status: affected, version: < 618
status: affected, version: < 730
}
{
product: SAP S/4HANA (S4CORE)
vendor: SAP SE
versions:
status: affected, version: < 100
status: affected, version: < 101
status: affected, version: < 102
status: affected, version: < 103
status: affected, version: < 104
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.0
]