Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
SAP_SE · SAP S/4HANA (Private Cloud or On-Premise)
A code injection flaw in the function module exposed via RFC in SAP S/4HANA (Private Cloud or On-Premise) allows arbitrary ABAP code to be injected into the system. An attacker with low-privilege user access over the network, requiring no user interaction and no special configuration, can bypass essential authorization checks and fully compromise the system's confidentiality, integrity and availability.
SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 23 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 29 days after disclosure.
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+23 days
- Public exploit codePoC-in-GitHub+29 days
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.