PT-2023-27931 · Sap · S/4Hana
CVE-2023-41368
·
Published
2023-09-11
·
Updated
2023-09-14
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
S4 HANA versions 102 through 107
Description
The OData service of the S4 HANA, specifically in the Manage checkbook apps, allows an attacker to change the checkbook name by simulating an update OData call.
Recommendations
For versions 102 through 107, consider restricting access to the OData service until a patch is available.
As a temporary workaround, avoid using the OData service for update calls related to checkbook names until the issue is resolved.
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
S/4Hana