CVE-2023-40625

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and integrity with no impact on availibility of the system.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP Manage Purchase Contracts App	S4CORE 102; S4CORE 103; S4CORE 104; S4CORE 105; S4CORE 106; S4CORE 107

References

https://me.sap.com/notes/3326361Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://me.sap.com/notes/3326361Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Sep 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-406267.5The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible informa CVE-2023-406276.1A reflected XSS vulnerability was discovered in the LivingWord component for Joomla.CVE-2023-406286.1A reflected XSS vulnerability was discovered in the Extplorer component for Joomla.CVE-2023-406299.8SQLi vulnerability in LMS Lite component for Joomla.CVE-2023-40635.3Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request.CVE-2023-406309.8Unauthenticated LFI/SSRF in JCDashboards component for Joomla.CVE-2023-406314.4In Dialer, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges ne CVE-2023-406327.5In jpg driver, there is a possible use after free due to a logic error. This could lead to remote information disclosure no additional execu CVE-2023-406335.5In phasecheckserver, there is a possible missing permission check. This could lead to local information disclosure with no additional execut CVE-2023-406347.8In phasechecksercer, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execu CVE-2023-406357.8In linkturbo, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution pr CVE-2023-406364.4In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead t