PT-2023-19676 · Sap · Sap Erp+1

Published 2023-02-14 · Updated 2023-04-12 · CVE-2023-24528

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) version 600

Description The issue allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data. This endpoint is normally exposed over the network and successful exploitation can lead to exposure of data like travel documents.

Recommendations For version 600, consider restricting access to the misconfigured application endpoint to minimize the risk of exploitation. As a temporary workaround, review and correct the configuration of the exposed endpoint to prevent unauthorized access. Ensure that only necessary personnel have access to sensitive data and implement additional security measures to protect against potential attacks.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-24528

Affected Products

Sap Erp

Sap Fiori Apps For Travel Management

References · 6

• https://osv.dev/vulnerability/CVE-2023-24528 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3290901 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24528 · Security Note
• https://t.me/cvenotify/48066 · Telegram Post
• https://t.me/cibsecurity/58051 · Telegram Post