CVE-2023-24528

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data. This endpoint is normally exposed over the network and successful exploitation can lead to exposure of data like travel documents.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-245296.1Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75 CVE-2023-24538.8There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requir CVE-2023-245309.1SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code th CVE-2023-245319.8Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executi CVE-2023-245325.3The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a CVE-2023-245337.5Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked CVE-2023-245347.5HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of servic CVE-2023-245357.5Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more CVE-2023-245367.5Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This CVE-2023-245377.5Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loo CVE-2023-245389.8Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, si CVE-2023-245397.3Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated