« Volver al listado

CVE-2026-23688

Estado: AnalizadaMedia (4.3)—

SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — S4core

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-23688",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-23688",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-10T17:18:26.924360Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Fiori App (Manage Service Entry Sheets - Lean Services)",
          "versions": [
            {
              "status": "affected",
              "version": "S4CORE 102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            },
            {
              "status": "affected",
              "version": "107"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-10T04:16:03.340",
  "references": [
    {
      "url": "https://me.sap.com/notes/3215823",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted."
    },
    {
      "lang": "es",
      "value": "La aplicación SAP Fiori Gestionar Hojas de Entrada de Servicios no realiza las comprobaciones de autorización necesarias para un usuario autenticado, resultando en una escalada de privilegios. Esto tiene bajo impacto en la integridad, la confidencialidad y la disponibilidad no se ven afectadas."
    }
  ],
  "lastModified": "2026-06-17T10:21:57.540",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04C95A73-48EB-446C-A5F0-20E1D6BC1779"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C3C9003-68A6-4886-8979-9B7D01A35E40"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "964023CE-6EA4-42BB-93B2-DCE6B36D3F89"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84B775EF-6C11-4FAB-B5E7-8F6C4C5674BE"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:106:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14D17245-5B6D-4024-AFA6-8E0A70B294BF"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:107:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DEFABE8-1797-4C7B-941C-3205AE90914B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}