github - ghsa-89fv-9763-xj44

ghsa-89fv-9763-xj44

Vulnerability from github

Published

2024-04-09 03:30

Modified

2024-04-09 03:30

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.

Show details on source website

JSON

To clipboard

{
   affected: [],
   aliases: [
      "CVE-2024-28167",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-862",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2024-04-09T01:15:49Z",
      severity: "MODERATE",
   },
   details: "SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.\n\n",
   id: "GHSA-89fv-9763-xj44",
   modified: "2024-04-09T03:30:52Z",
   published: "2024-04-09T03:30:52Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2024-28167",
      },
      {
         type: "WEB",
         url: "https://me.sap.com/notes/3442378",
      },
      {
         type: "WEB",
         url: "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
         type: "CVSS_V3",
      },
   ],
}

cve-2024-28167

Vulnerability from cvelistv5

Published

2024-04-09 00:55

Modified

2024-08-02 00:48

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

References

▼	URL	Tags
	https://me.sap.com/notes/3442378
	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364

Impacted products

	Vendor	Product	Version
	SAP_SE	SAP Group Reporting Data Collection (Enter Package Data)	Version: S4CORE 104 Version: S4CORE 105 Version: S4CORE 106 Version: S4CORE 107 Version: S4CORE 108 Version: SAP_GRDC_CLOUD 1.0.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:sap_se:sap_group_reporting_data_collection:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "sap_group_reporting_data_collection",
                  vendor: "sap_se",
                  versions: [
                     {
                        status: "affected",
                        version: "s4core_104",
                     },
                     {
                        status: "affected",
                        version: "s4core_105",
                     },
                     {
                        status: "affected",
                        version: "s4core_106",
                     },
                     {
                        status: "affected",
                        version: "s4core_107",
                     },
                     {
                        status: "affected",
                        version: "s4core_108",
                     },
                     {
                        status: "affected",
                        version: "sap_grdc_cloud_1.0.0",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-28167",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-04-09T15:19:15.843400Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-08-01T20:35:37.803Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T00:48:49.373Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://me.sap.com/notes/3442378",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "SAP Group Reporting Data Collection (Enter Package Data)",
               vendor: "SAP_SE",
               versions: [
                  {
                     status: "affected",
                     version: "S4CORE 104",
                  },
                  {
                     status: "affected",
                     version: "S4CORE 105",
                  },
                  {
                     status: "affected",
                     version: "S4CORE 106",
                  },
                  {
                     status: "affected",
                     version: "S4CORE 107",
                  },
                  {
                     status: "affected",
                     version: "S4CORE 108",
                  },
                  {
                     status: "affected",
                     version: "SAP_GRDC_CLOUD 1.0.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "<p>SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.</p>",
                  },
               ],
               value: "SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-862",
                     description: "CWE-862: Missing Authorization",
                     lang: "eng",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-04-09T00:55:46.326Z",
            orgId: "e4686d1a-f260-4930-ac4c-2f5c992778dd",
            shortName: "sap",
         },
         references: [
            {
               url: "https://me.sap.com/notes/3442378",
            },
            {
               url: "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data)",
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "e4686d1a-f260-4930-ac4c-2f5c992778dd",
      assignerShortName: "sap",
      cveId: "CVE-2024-28167",
      datePublished: "2024-04-09T00:55:46.326Z",
      dateReserved: "2024-03-06T06:12:27.005Z",
      dateUpdated: "2024-08-02T00:48:49.373Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted