CVE-2024-42376

Summary

SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. On successful exploitation, an attacker can cause a high impact on confidentiality of the application.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP Shared Service FrameworkSAP_BS_FND 702affected
SAP_SESAP Shared Service Framework731affected
SAP_SESAP Shared Service Framework746affected
SAP_SESAP Shared Service Framework747affected
SAP_SESAP Shared Service Framework748affected

Weaknesses

  • CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References