Information Disclosure in SAP Bank Account Management (Manage Banks) (SAP Bank Account Management (Manage Banks))
At a glance
- Source
- NVD
- EPSS
- EPSS 0.52 % · percentile 44 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Modified
Description
In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. They might get captured in log files, bookmarks, and so on disclosing sensitive data of the application.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N | sap |
| CVSS 3.1 | MEDIUM 4.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-12128
- GCVE · GCVE-0-2023-0023
CERT-FR advisories
- CERTFR-2024-AVI-0671 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0019 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:bank_account_management:800:*:*:*:*:*:*:*cpe:2.3:a:sap:bank_account_management:900:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP · Bank Account Management (Manage Banks) | affected 800 ; affected 900 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |