Application Server ABAP vulnerabilities

A Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform allows an authenticated attacker to misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow writing or modifying data accessible via FORMs and invoking system functionality, resulting in high impact on integrity and availability, while confidentiality remains unaffected.

The ABAP application server does not perform necessary authorization checks for an authenticated user, allowing execution of a report generation command that can overwrite another user's data, leading to privilege escalation. This has high impact on integrity, low on availability, and no impact on confidentiality.

An Information Disclosure vulnerability in Application Server ABAP allows an authenticated attacker to read unmasked values displayed in ABAP Lists. Successful exploitation could lead to unauthorized disclosure of data, resulting in a high impact on confidentiality without affecting integrity or availability.