Medium severity · published May 9, 2023
CVE-2023-32112
Vendor Master Hierarchy - versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618,…
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
Vendor Master Hierarchy - versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618, S4CORE 100, does not perform necessary authorization checks for an authenticated user to access some of its function. This could lead to modification of data impacting the integrity of the system.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S4
S4core · Sap
100 · source: NVD
VM
Vendor Master Hierarchy · Sap
sap_appl_500; sap_appl_600; sap_appl_602; sap_appl_603; sap_appl_604; sap_appl_605; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32112
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32112
Broken Link
https://launchpad.support.sap.com/#/notes/2335198
Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
More from S4core
9.1
CVE-2021-33701
DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102,…
8.8
CVE-2018-2484
SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0;…
7.3
CVE-2023-35870
When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change…
6.5
CVE-2024-39592
Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges
6.1
CVE-2026-24323
Multiple vulnerabilities in BSP Applications of SAP Document Management System