Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA (SAP_SE SAP Human Capital Management for SAP S/4HANA)
En bref
- Source
- NVD
- EPSS
- EPSS 0.27 % · centile 19 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Analyzed
Description
During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information causing a high impact on confidentiality, while integrity and availability are unaffected.
Faiblesses (CWE)
- CWE-204 — Écart observable dans la réponse
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | sap |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · cna@sap.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-22174
- GCVE · GCVE-0-2026-34264
Avis du CERT-FR
- CERTFR-2026-AVI-0434 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:human_capital_management:s4hcmrxx_100:*:*:*:*:*:*:*cpe:2.3:a:sap:human_capital_management:s4hcmrxx_101:*:*:*:*:*:*:*cpe:2.3:a:sap:human_capital_management:s4hcmrxx_102:*:*:*:*:*:*:*cpe:2.3:a:sap:human_capital_management:sap_hrrxx_600:*:*:*:*:*:*:*cpe:2.3:a:sap:human_capital_management:sap_hrrxx_604:*:*:*:*:*:*:*cpe:2.3:a:sap:human_capital_management:sap_hrrxx_608:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP Human Capital Management for SAP S/4HANA | affected S4HCMRXX 100 ; affected 101 ; affected 102 ; affected SAP_HRRXX 600 ; affected 604 ; affected 608 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |