Description
The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP SE | SAP Master Data Governance (S4CORE) | < 101 | — |
| SAP SE | SAP Master Data Governance (S4FND) | < 102, < 103, < 104 | — |
| SAP SE | SAP Master Data Governance (SAP_BS_FND) | < 748 | — |