Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) (SAP_SE SAP Fiori App (Intercompany Balance Reconciliation))
En bref
- Source
- NVD
- EPSS
- EPSS 0.18 % · centile 7 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Deferred
Description
SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application.
Faiblesses (CWE)
- CWE-15 — External Control of System or Configuration Setting
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.1 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L | sap |
| CVSS 3.1 | MEDIUM 5.1 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L | NVD · cna@sap.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-2391
- GCVE · GCVE-0-2026-0495
Avis du CERT-FR
- CERTFR-2026-AVI-0034 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP Fiori App (Intercompany Balance Reconciliation) | affected UIAPFI70 500 ; affected 600 ; affected 700 ; affected 800 ; affected 900 ; affected 901 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |