Executive Summary

This vulnerability exists in SAP Strategic Enterprise Management, specifically in the Scorecard Wizard component within Business Server Pages. It is caused by a missing authorization check, which allows an authenticated attacker to access information they should not be authorized to view.

Additionally, the attacker can change default settings and modify value fields, which can mislead risk evaluations and falsely lower assessed risk levels.

The impact on confidentiality and integrity is considered low, and there is no impact on the availability of the application.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability could gain unauthorized access to sensitive information within the SAP Strategic Enterprise Management system.

They could also alter default settings and modify value fields, which may lead to incorrect risk evaluations and falsely lower the assessed risk levels.

This could result in decisions being made based on inaccurate data, potentially affecting business risk management processes.

However, the overall impact on confidentiality and integrity is low, and the availability of the application is not affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated attacker to access unauthorized information and modify default settings, which can mislead risk evaluations and falsely lower assessed risk levels. Such unauthorized access and data manipulation could potentially impact compliance with standards and regulations that require strict controls on data confidentiality and integrity, such as GDPR and HIPAA.

However, the impact is described as low on confidentiality and integrity, and there is no impact on availability. The specific effect on compliance would depend on the sensitivity of the data accessed or altered and the regulatory requirements for protecting that data.

Useful 0 Not Useful 0