CVE-2024-30216
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, attacker can add notes in the review request with 'completed' status affecting the integrity of the application. Confidentiality and Availability are not impacted.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP_SE | SAP S/4 HANA (Cash Management) | S4CORE 103 | affected |
| SAP_SE | SAP S/4 HANA (Cash Management) | S4CORE 104 | affected |
| SAP_SE | SAP S/4 HANA (Cash Management) | S4CORE 105 | affected |
| SAP_SE | SAP S/4 HANA (Cash Management) | S4CORE 106 | affected |
| SAP_SE | SAP S/4 HANA (Cash Management) | S4CORE 107 | affected |
| SAP_SE | SAP S/4 HANA (Cash Management) | S4CORE 108 | affected |
Weaknesses
- CWE-862: CWE-862: Missing Authorization
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
CVE Program Container
Additional References
- https://me.sap.com/notes/3427178
- https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
References
- https://me.sap.com/notes/3427178
- https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.