CVE Vulnerability Catalog

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the victim into performing unintended actions, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

A Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence allows an attacker to cause the server to initiate arbitrary outbound requests. Combined with XML/XSL processing, this could enable script execution. Successful exploitation may have a low impact on confidentiality, integrity, and availability.

The @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application, and partial impact on confidentiality of business data.

SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server allow an authenticated low-privileged attacker to access certain administrative functionality or interfaces and obtain sensitive system state information, resulting in information disclosure. This could facilitate further attacks. The vulnerability has a high impact on confidentiality, with no impact on integrity or availability.

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with crafted content, leading to arbitrary code execution in the user's context upon next launch. This results in high impact on confidentiality, integrity, and availability.

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. This could expose security-relevant settings and internal system details, with low impact on confidentiality while integrity and availability remain unaffected.

SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain functionality. A low-privileged attacker could send specially crafted requests to delete entries that should not be accessible. This results in a low impact on availability, with no impact on confidentiality and integrity.

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests. A low-privileged attacker could craft a malicious link or page. If an authenticated victim interacts, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity, with no impact on availability.

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests. A low-privileged attacker could craft a malicious link or page. If an authenticated victim interacts, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity, with no impact on availability.

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests. A low-privileged attacker could craft a malicious link or page. If an authenticated victim interacts, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity, with no impact on availability.

SAP Integration Suite does not sufficiently validate XML documents from untrusted sources in certain internal components. An attacker with low privileges could submit crafted XML payloads with malicious external entity declarations, potentially reading sensitive files from the server and exposing them via monitoring or logs, resulting in high confidentiality impact. It could also lead to resource exhaustion, causing low availability impact. No integrity impact.

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on confidentiality, integrity, and availability.

An unauthenticated user can send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability.

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access could register an unauthorized component and potentially perform unauthorized actions, resulting in high impact on confidentiality, integrity, and availability.

The vulnerability in SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests with deeply nested entity definitions, which could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact on availability with no impact on confidentiality and integrity.

SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow access to sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability.

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request with a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have high impact on confidentiality, integrity, and availability.

Vulnerability in knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.

Vulnerability in knowns before version 0.30.0 serves the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.

Vulnerability in knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the server process.