CVE-2026-44770— SAP S/4 HANA 缺少授权检查漏洞
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud Storage新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-44770の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Missing Authorization check in SAP S/4 HANA (Create Single Payment)
ソース: NVD (National Vulnerability Database)
脆弱性説明
SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific entity set keys resulting in disclosure of information. This has low impact on confidentiality, with no impact on integrity and availability of the application.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
授权机制缺失
ソース: NVD (National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| SAP_SE | SAP S/4 HANA (Create Single Payment) | S4CORE 102 | - |
II. CVE-2026-44770の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-44770のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-44770 其他参考 (1)
Same Patch Batch · SAP_SE · 2026-07-14 · 15 CVEs total
| CVE-2026-44747 | 9.9 CRITICAL | Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP |
| CVE-2026-44761 | 9.1 CRITICAL | Insecure Sample Credentials in SAP Commerce Cloud |
| CVE-2026-27690 | 9.1 CRITICAL | HTTP Request Smuggling in SAP Approuter |
| CVE-2026-0487 | 8.4 HIGH | DLL Hijacking vulnerability in SAProuter on Microsoft Windows |
| CVE-2026-44752 | 8.2 HIGH | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configur |
| CVE-2026-44745 | 8.1 HIGH | Open Redirect vulnerability in SAP Approuter |
| CVE-2026-58233 | 7.6 HIGH | Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsatt |
| CVE-2026-44767 | 6.1 MEDIUM | Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection |
| CVE-2026-44759 | 6.1 MEDIUM | Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-44769 | 5.5 MEDIUM | SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO) |
| CVE-2026-44760 | 4.7 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applica |
| CVE-2026-44771 | 4.3 MEDIUM | Missing Authorization check in SAP S/4HANA (Draft operation) |
| CVE-2026-44768 | 4.1 MEDIUM | Security misconfiguration in SAP CRM (WebClient UI) |
| CVE-2026-44753 | 3.7 LOW | Information Disclosure vulnerability in SAP HANA Extended Application Services classic mod |
IV. 関連脆弱性
同じベンダー: SAP_SE
- CVE-2026-44767
Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS - CVE-2026-58233
Remote Code Execution vulnerability in SAP Change and Transp - CVE-2026-44771
Missing Authorization check in SAP S/4HANA (Draft operation) - CVE-2026-44769
SQL Injection vulnerability in SAP S/4HANA Project Managemen - CVE-2026-44768
Security misconfiguration in SAP CRM (WebClient UI)
同じ弱点: CWE-862
- CVE-2026-14504
Nexus Repository 3 - Authorization Bypass in Component Uploa - CVE-2026-60119
Hi.Events v1.10.0-beta XSS via Event Title JSON.stringify In - CVE-2026-60118
Hi.Events v1.10.0-beta Hidden Ticket Enumeration via Order C - CVE-2026-11802
FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenti - CVE-2026-44771
Missing Authorization check in SAP S/4HANA (Draft operation)
V. CVE-2026-44770へのコメント
まだコメントはありません