CVE-2023-42475 Information Disclosure Vulnerability in Statutory Reporting
A low-privileged attacker can read server files due to a vulnerable file storage location in the Statutory Reporting application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-42475?
CVE-2023-42475 is a medium-severity vulnerability in SAP_SE SAP S/4HANA Core, published on 10 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.
Weakness: CWE-209
Which versions are affected by CVE-2023-42475?
It affects 1 product.
Products include Sap S\/4hana.
How do I fix CVE-2023-42475?
No fix has been published for CVE-2023-42475 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-42475 being exploited?
There is no known exploitation of CVE-2023-42475 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP S/4HANA Core
- CVE-2022-22530 File upload in SAP S/4HANA
- CVE-2022-22531 File upload in SAP S/4HANA
- CVE-2023-24524 Missing authorization in S/4 HANA (Map Treasury Correspondence Format Data)
- CVE-2022-22542 Information disclosure in SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)
- CVE-2023-40306 URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)
Sources
Also known as GHSA-wj24-9p82-86v2.