Insufficient Authorization Leads to Data Tampering in SAP Group Reporting Data Collection
CVE-2024-28167

Currently unrated

Key Information:

Vendor
SAP
Vendor
CVE Published:
9 April 2024

Summary

SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.

References

https://me.sap.com/notes/3442378
https://support.sap.com/en/my-support/knowledge-base/secu...

Timeline

  • Vulnerability published

.