Missing Authorization check in SAP BW/4HANA Transformation and DTP (SAP_SE SAP BW/4HANA Transformation and Data Transfer Process)
En bref
- Source
- NVD
- EPSS
- EPSS 0.28 % · centile 20 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Modified
Description
SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low impacts on the integrity and availability of the application.
Faiblesses (CWE)
- CWE-862 — Autorisation absente
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L | sap |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-36482
- GCVE · GCVE-0-2024-37176
Avis du CERT-FR
- CERTFR-2024-AVI-0671 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0477 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:bw\/4hana:300:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:400:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:750:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:751:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:752:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:753:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:754:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:755:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:756:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:757:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:758:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:796:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:dw4core_200:*:*:*:*:*:*:*cpe:2.3:a:sap:bw\/4hana:sap_bw_740:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP BW/4HANA Transformation and Data Transfer Process | affected DW4CORE 200 ; affected 300 ; affected 400 ; affected 796 ; affected SAP_BW 740 ; affected 750 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |