CVE-2024-45286 - Missing Authorization check in SAP Production and Revenue Accounting (Tobin interface)

Back Back to CVE browser

MEDIUM

Missing Authorization check in SAP Production and Revenue Accounting (Tobin interface)

Published Sep 10, 2024

6.5

MEDIUM

CVSS 3.1

EPSS 0.33%

Description

Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Production and Revenue Accounting allows unauthorized access that could lead to disclosure of highly sensitive data. There is no impact on integrity or availability.

Affected products

Vendor SAP SE Product SAP Production and Revenue Accounting (Tobin interface) Default
unaffected
Affected
- IS-PRA 605
- IS-PRA 606
- IS-PRA 616
- IS-PRA 617
- IS-PRA 618
- IS-PRA 800
- IS-PRA 801
- IS-PRA 802
- IS-PRA 803
- IS-PRA 804
- IS-PRA 805
- S4CEXT 106
- S4CEXT 107
- S4CEXT 108

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
SAP SE	SAP Production and Revenue Accounting (Tobin interface)	unaffected	Affected IS-PRA 605 IS-PRA 606 IS-PRA 616 IS-PRA 617 IS-PRA 618 IS-PRA 800 IS-PRA 801 IS-PRA 802 IS-PRA 803 IS-PRA 804 IS-PRA 805 S4CEXT 106 S4CEXT 107 S4CEXT 108