Read the docs
TI-2023-15415 Aliases CVE-2023-32112GHSA-5vh6-vprx-fjvm

Missing Authorization Check in Vendor Master Hierarchy

Priority LOW 24CWE-862Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

Vendor Master Hierarchy - versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618, S4CORE 100, does not perform necessary authorization checks for an authenticated user to access some of its function. This could lead to modification of data impacting the integrity of the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00149 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPVendor Master HierarchySAP_APPL 500; SAP_APPL 600; SAP_APPL 602; SAP_APPL 603; SAP_APPL 604; SAP_APPL 605; SAP_APPL 606; SAP_APPL 616; SAP_APPL 617; SAP_APPL 618; S4CORE 100—No fix listedCNA
  • Vendor Master Hierarchy VendorSAP Affected SAP_APPL 500; SAP_APPL 600; SAP_APPL 602; SAP_APPL 603; SAP_APPL 604; SAP_APPL 605; SAP_APPL 606; SAP_APPL 616; SAP_APPL 617; SAP_APPL 618; S4CORE 100 Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:sap:s4core:100:*:*:*:*:*:*:*100VulnerableSAP
cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_500:*:*:*:*:*:*:*sap_appl_500VulnerableSAP
cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_600:*:*:*:*:*:*:*sap_appl_600VulnerableSAP
cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_602:*:*:*:*:*:*:*sap_appl_602VulnerableSAP
cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_603:*:*:*:*:*:*:*sap_appl_603VulnerableSAP
cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_604:*:*:*:*:*:*:*sap_appl_604VulnerableSAP
cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_605:*:*:*:*:*:*:*sap_appl_605VulnerableSAP
cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_606:*:*:*:*:*:*:*sap_appl_606VulnerableSAP
cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_616:*:*:*:*:*:*:*sap_appl_616VulnerableSAP
cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_617:*:*:*:*:*:*:*sap_appl_617VulnerableSAP
  • cpe:2.3:a:sap:s4core:100:*:*:*:*:*:*:* Versions 100 Vulnerable ·SAP
  • cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_500:*:*:*:*:*:*:* Versions sap_appl_500 Vulnerable ·SAP
  • cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_600:*:*:*:*:*:*:* Versions sap_appl_600 Vulnerable ·SAP
  • cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_602:*:*:*:*:*:*:* Versions sap_appl_602 Vulnerable ·SAP
  • cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_603:*:*:*:*:*:*:* Versions sap_appl_603 Vulnerable ·SAP
  • cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_604:*:*:*:*:*:*:* Versions sap_appl_604 Vulnerable ·SAP
  • cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_605:*:*:*:*:*:*:* Versions sap_appl_605 Vulnerable ·SAP
  • cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_606:*:*:*:*:*:*:* Versions sap_appl_606 Vulnerable ·SAP
  • cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_616:*:*:*:*:*:*:* Versions sap_appl_616 Vulnerable ·SAP
  • cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_617:*:*:*:*:*:*:* Versions sap_appl_617 Vulnerable ·SAP
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_618:*:*:*:*:*:*:*sap_appl_618VulnerableSAP
  • cpe:2.3:a:sap:vendor_master_hierarchy:sap_appl_618:*:*:*:*:*:*:* Versions sap_appl_618 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32112
  2. 2026-10-03 Alias added: GHSA-5vh6-vprx-fjvm

References

Advisory 1

Other 1

  • TI-2021-13075 SQL injection in SAP DMIS Mobile Plug-In CVSS 3.1CRITICAL 9.1
  • TI-2018-01862 Missing authorization in SAP Enterprise Financial Services CVSS 3.1HIGH 8.8
  • TI-2024-26522 [CVE-2024-39592] Missing Authorization check in SAP PDCE CVSS 3.1HIGH 7.7
  • TI-2023-17941 Improper Access Control in SAP S/4HANA (Manage Journal Entry Template) CVSS 3.1HIGH 7.3
  • TI-2026-19607 Multiple vulnerabilities in BSP Applications of SAP Document Management System CVSS 3.1MEDIUM 6.1
  • TI-2026-00313 Multiple vulnerabilities in BSP Applications of SAP Document Management System CVSS 3.1MEDIUM 6.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences