SQL Injection in Sap Master Data Synchronization
CVE-2023-32115
An attacker can exploit MDS COMPARE TOOL and use specially crafted inputs to read and modify database commands, resulting in the retrieval of additional information persisted by the system.
Vulnerability class: SQL Injection
EPSS: 0.002 (12.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N.
Affected products
- Sap Master_data_synchronization — versions 600, 602, 603
- Sap_se Master Data Synchronization (Mds Compare Tool) — versions SAP_APPL 600, SAP_APPL 602, SAP_APPL 603
Weakness classification (CWE)
References
- cna@sap.com (Permissions Required)
- cna@sap.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-32115?
- CVE-2023-32115 is a medium-severity vulnerability in Sap Master Data Synchronization, classified under SQL Injection. CVSS score: 4.2/10. Published 2023-06-13.
- How severe is CVE-2023-32115?
- Medium severity. CVSS v3 base score is 4.2 out of 10.