CVE-2023-35870
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
When creating a journal entry template in SAP S/4HANA, an attacker could intercept the save request and change the template, impacting the confidentiality and integrity of the resource. Additionally, a standard template could be deleted, leading to temporary unavailability of the resource.
Risk Assessment
The risk to the organization involves potential breaches of data confidentiality and integrity, as well as temporary unavailability of critical resources.
Recommendation
It is recommended to implement appropriate security mechanisms to prevent request interception and to monitor and audit changes to journal entry templates.
Original NVD description (English source)
When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change the template, leading to an impact on confidentiality and integrity of the resource. Furthermore, a standard template could be deleted, hence making the resource temporarily unavailable.