Sap Cloud Connector
Monthly
Low-privileged attackers positioned on a network adjacent to an SAP Cloud Connector can extract limited information about internal systems by sending specially crafted requests that slip past a flawed authorization check. Exploitation carries a dual prerequisite - adjacency to the connector (AV:A, so not reachable from the public internet) plus valid low-privilege credentials (PR:L) - and the resulting impact is confined to low confidentiality loss with no effect on integrity or availability, which is why this is assessed as a genuinely low-priority issue despite being a real vulnerability at CVSS 3.5. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); no EPSS data was supplied with this report.
Low-privileged attackers positioned on a network adjacent to an SAP Cloud Connector can extract limited information about internal systems by sending specially crafted requests that slip past a flawed authorization check. Exploitation carries a dual prerequisite - adjacency to the connector (AV:A, so not reachable from the public internet) plus valid low-privilege credentials (PR:L) - and the resulting impact is confined to low confidentiality loss with no effect on integrity or availability, which is why this is assessed as a genuinely low-priority issue despite being a real vulnerability at CVSS 3.5. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); no EPSS data was supplied with this report.