CVE-2023-47031

The vulnerability exists in the SOAP API component of NCR Terminal Handler, specifically in the role-granting functionality. The root cause is classified as CWE-284 (Improper Access Control), indicating that the SOAP endpoints fail to properly validate user privileges before processing role assignment requests. SOAP (Simple Object Access Protocol) services, traditionally reliant on XML parsing and WS-Security mechanisms, require robust authorization checks on each operation. In this case, the grantRolesToUsers, grantRolesToGroups, and grantRolesToOrganization endpoints lack sufficient access controls, allowing unauthenticated or low-privileged users to invoke administrative functions. The affected product is NCR Terminal Handler v1.5.1 (CPE likely: cpe:2.3:a:ncr:terminal_handler:1.5.1:*:*:*:*:*:*:*), a critical component in NCR's point-of-sale and transaction processing infrastructure. The SOAP API exposure suggests these endpoints are accessible over HTTP/HTTPS without adequate WS-Security policies or role-based access control validation.