Executive Summary

This vulnerability exists due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise). An authenticated attacker can execute a specific ABAP report that allows them to overwrite any existing eight-character executable ABAP report without proper authorization.

If the overwritten report is later executed, its intended functionality could become unavailable, causing disruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability impacts the availability of certain ABAP reports in SAP ERP and SAP S/4HANA systems by allowing an authenticated attacker to overwrite executable reports without authorization. The confidentiality of data remains unaffected, and the integrity impact is limited to the overwritten report.

Since the vulnerability primarily affects availability and has limited impact on integrity, it could potentially affect compliance with standards that require system availability and integrity, such as HIPAA and GDPR. However, there is no direct information provided about specific compliance implications or regulatory breaches.

Useful 0 Not Useful 0

Impact Analysis

Successful exploitation of this vulnerability impacts the availability of the affected ABAP reports, potentially causing them to become unusable.

There is a limited impact on integrity, confined only to the overwritten report, but confidentiality is not affected.

Useful 0 Not Useful 0