Improper Access Control in SAP Fiori Front End Server (SAP_SE SAP Fiori Front End Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.30 % · percentile 23 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Analyzed
Description
SAP Fiori Front End Server - version 605, allows altering of approver details on the read-only field when sending leave request information. This could lead to creation of request with incorrect approver causing low impact on Confidentiality and Integrity with no impact on Availability of the application.
Weaknesses (CWE)
- CWE-863 — Incorrect Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | sap |
| CVSS 3.1 | MEDIUM 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-19729
- GCVE · GCVE-0-2024-22133
CERT-FR advisories
- CERTFR-2024-AVI-0209 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:fiori_front_end_server:605:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP Fiori Front End Server | affected 605 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |