Sap Manufacturing Integration And Intelligence
Monthly
Unauthenticated remote access to SAP Manufacturing Integration and Intelligence (MII) scheduling functions is possible due to a missing authorization check on scheduling-related API endpoints. Any network-reachable attacker without credentials can retrieve, create, modify, or delete scheduling data managed by the application, impacting confidentiality, integrity, and availability at a low severity level each. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploitation conditions - no authentication, no user interaction, low complexity - lower the barrier to opportunistic abuse significantly.
Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend operations to unauthenticated remote attackers via crafted HTTP requests with specific parameter values. Successful exploitation grants read, create, modify, and delete access to application-managed business data, producing a limited but tripartite impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at this time, though the zero-privilege network vector lowers the bar for opportunistic probing.
Path traversal in SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to write files outside intended directory boundaries by supplying specially crafted input to affected file path validation functions. Exploitation requires a legitimate user to subsequently interact with the attacker-influenced content and depends on conditions outside the attacker's direct control, as reflected by the AC:H and UI:R CVSS metrics. Successful exploitation achieves a scope change affecting adjacent components with high impact on confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing exist at time of analysis.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (SAP MII) allows an authenticated low-privilege network attacker to force the server to initiate arbitrary outbound HTTP/network requests. When the application processes the resulting content through its XML/XSL pipeline, the SSRF can be chained to trigger script execution, resulting in low-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed as part of SAP Security Patch Day.
Missing authorization enforcement in SAP Manufacturing Integration and Intelligence (MII) versions 15.4 and 15.5 allows any low-privileged authenticated user to access user account information that is intended to be restricted to privileged roles. The exposed account data - names, identifiers, or contact details of privileged users - can directly enable targeted follow-on attacks such as spear phishing or credential stuffing against identified administrator accounts. No public exploit code or active exploitation has been identified at time of analysis; CVSS 3.1 rates this Medium (4.3) with low confidentiality impact and no integrity or availability impact.
Unauthenticated remote access to SAP Manufacturing Integration and Intelligence (MII) scheduling functions is possible due to a missing authorization check on scheduling-related API endpoints. Any network-reachable attacker without credentials can retrieve, create, modify, or delete scheduling data managed by the application, impacting confidentiality, integrity, and availability at a low severity level each. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploitation conditions - no authentication, no user interaction, low complexity - lower the barrier to opportunistic abuse significantly.
Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend operations to unauthenticated remote attackers via crafted HTTP requests with specific parameter values. Successful exploitation grants read, create, modify, and delete access to application-managed business data, producing a limited but tripartite impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at this time, though the zero-privilege network vector lowers the bar for opportunistic probing.
Path traversal in SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to write files outside intended directory boundaries by supplying specially crafted input to affected file path validation functions. Exploitation requires a legitimate user to subsequently interact with the attacker-influenced content and depends on conditions outside the attacker's direct control, as reflected by the AC:H and UI:R CVSS metrics. Successful exploitation achieves a scope change affecting adjacent components with high impact on confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing exist at time of analysis.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (SAP MII) allows an authenticated low-privilege network attacker to force the server to initiate arbitrary outbound HTTP/network requests. When the application processes the resulting content through its XML/XSL pipeline, the SSRF can be chained to trigger script execution, resulting in low-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed as part of SAP Security Patch Day.
Missing authorization enforcement in SAP Manufacturing Integration and Intelligence (MII) versions 15.4 and 15.5 allows any low-privileged authenticated user to access user account information that is intended to be restricted to privileged roles. The exposed account data - names, identifiers, or contact details of privileged users - can directly enable targeted follow-on attacks such as spear phishing or credential stuffing against identified administrator accounts. No public exploit code or active exploitation has been identified at time of analysis; CVSS 3.1 rates this Medium (4.3) with low confidentiality impact and no integrity or availability impact.