This vulnerability involves a missing authorization check (CWE-862) in SAP Manufacturing Integration and Intelligence 15.5. An attacker without authentication can craft requests to the Cost Servlet endpoint with specific parameters that, if processed, grant access to backend operations. This unauthorized access could lead to unauthorized reading, creation, modification, or deletion of application-managed business data. The CVSS 3.1 base score is 7.3, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to access backend operations and manipulate business data, resulting in limited impact on confidentiality, integrity, and availability of the affected system. This could lead to unauthorized disclosure, modification, or deletion of sensitive business information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Organizations using SAP Manufacturing Integration and Intelligence version 15.5 should monitor SAP's advisories for updates and apply patches or mitigations once available.