Missing Authorization Check in ABAP based SAP systems (SAP_SE ABAP based SAP systems)
En bref
- Source
- NVD
- EPSS
- EPSS 0.19 % · centile 9 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Analyzed
Description
In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system information.This has low impact on confidentiality. Integrity and availability are not impacted.
Faiblesses (CWE)
- CWE-862 — Autorisation absente
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N | sap |
| CVSS 3.1 | MEDIUM 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2026-6873
- GCVE · GCVE-0-2026-0486
Avis du CERT-FR
- CERTFR-2026-AVI-0141 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:solution_tools_plug-in:740:*:*:*:*:*:*:*cpe:2.3:a:sap:solution_tools_plug-in:758:*:*:*:*:*:*:*cpe:2.3:a:sap:solution_tools_plug-in:2005_1_700:*:*:*:*:*:*:*cpe:2.3:a:sap:solution_tools_plug-in:2008_1_710:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · ABAP based SAP systems | affected ST-PI 2005_1_700 ; affected 2008_1_710 ; affected 740 ; affected 758 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |