PT-2023-27931 · Sap · S/4Hana

Published 2023-09-11 · Updated 2023-09-14 · CVE-2023-41368

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions S4 HANA versions 102 through 107

Description The OData service of the S4 HANA, specifically in the Manage checkbook apps, allows an attacker to change the checkbook name by simulating an update OData call.

Recommendations For versions 102 through 107, consider restricting access to the OData service until a patch is available. As a temporary workaround, avoid using the OData service for update calls related to checkbook names until the issue is resolved.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-41368

Affected Products

S/4Hana

References · 5

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41368 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41368 · Vendor Advisory
• https://me.sap.com/notes/3355675 · Note
• https://twitter.com/CVEnew/status/1701420506543456326 · Twitter Post