SAP S/4HANA (Intercompany Matching and Reconciliation) vulnerability

What happened

SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.

Affected versions

SAP S/4HANA (Intercompany Matching and Reconciliation): SAPSCORE 136; S4CORE 104; 105; 106; 107; 108; 109 Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.