SAP Manufacturing Integration and Intelligence vulnerabilities

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the system.

Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page displaying this content, the injected input is processed during web page generation, resulting in script execution in the victim's browser. This could allow the attacker to access session information, modify rendered page content, and disrupt the victim's use of the application, with low impact on confidentiality, integrity, and availability.

A Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence allows an attacker to cause the server to initiate arbitrary outbound requests. Combined with XML/XSL processing, this could enable script execution. Successful exploitation may have a low impact on confidentiality, integrity, and availability.

SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application functions, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker to access user account information in the application, which could be leveraged to facilitate further attacks. This vulnerability results in low impact on confidentiality, with no impact on integrity and availability.

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve, create, modify, or delete application-managed scheduling data, causing a low impact on confidentiality, integrity, and availability.

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed business data, resulting in a limited impact on the confidentiality, integrity, and availability of the affected system.

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker's control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability.