CVE-2023-35870

Summary

When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change the template, leading to an impact on confidentiality and integrity of the resource. Furthermore, a standard template could be deleted, hence making the resource temporarily unavailable.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP S/4HANA (Manage Journal Entry Template)S4CORE 104affected
SAP_SESAP S/4HANA (Manage Journal Entry Template)105affected
SAP_SESAP S/4HANA (Manage Journal Entry Template)106affected
SAP_SESAP S/4HANA (Manage Journal Entry Template)107affected

Weaknesses

  • CWE-732: CWE-732: Incorrect Permission Assignment for Critical Resource

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References