SAP S/4HANA 105

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

Published: 2026-02-10T03:01:08.999Z
Updated: 2026-02-26T15:04:14.152Z

Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can enable/disable the sharing rule of other users affecting the integrity of the application. Confidentiality and Availability are not affected.

Published: 2024-05-14T03:53:10.737Z
Updated: 2024-08-01T20:33:52.538Z

The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.

Published: 2023-10-10T01:37:36.327Z
Updated: 2024-09-28T22:13:00.204Z

SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity.

Published: 2023-09-08T21:05:24.877Z
Updated: 2024-09-25T20:04:01.418Z

SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to delete the data with a high impact to availability.

Published: 2023-02-14T03:17:59.139Z
Updated: 2025-03-20T20:30:54.464Z