SAP S/4HANA Supplier Invoice CRLF Injection Vulnerability

A CRLF injection vulnerability has been identified in SAP S/4HANA Supplier Invoice. This issue allows an attacker with user-level privileges to bypass the allowlist and inject untrusted sites into the 'Trusted Sites' configuration by adding line feed characters into application inputs. The vulnerability impacts the application's integrity, but does not affect confidentiality or availability.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of the 'Trusted Sites' configuration, allowing the injection of untrusted sites.

Remediation

Users are advised to review and implement the SAP Security Note related to this vulnerability, available through the SAP Security Patch Day Bulletin.