Lucene search

SapCVE-2024-42376

HistoryAug 13, 2024 - 4:15 a.m.

CVE-2024-42376

2024-08-1304:15:10

CWE-862

sap

web.nvd.nist.gov

sap

shared service framework

authorization check

privilege escalation

confidentiality impact

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

18.8%

JSON

SAP Shared Service Framework does not perform necessary
authorization check for an authenticated user, resulting in escalation of
privileges. On successful exploitation, an attacker can cause a high impact on
confidentiality of the application.

Affected configurations

Nvd

Node

sapshared_service_frameworkMatchsap_bs_fnd_702

sapshared_service_frameworkMatchsap_bs_fnd_731

sapshared_service_frameworkMatchsap_bs_fnd_746

sapshared_service_frameworkMatchsap_bs_fnd_747

sapshared_service_frameworkMatchsap_bs_fnd_748

VendorProductVersionCPE
sapshared_service_frameworksap_bs_fnd_702cpe:2.3:a:sap:shared_service_framework:sap_bs_fnd_702:*:*:*:*:*:*:*
sapshared_service_frameworksap_bs_fnd_731cpe:2.3:a:sap:shared_service_framework:sap_bs_fnd_731:*:*:*:*:*:*:*
sapshared_service_frameworksap_bs_fnd_746cpe:2.3:a:sap:shared_service_framework:sap_bs_fnd_746:*:*:*:*:*:*:*
sapshared_service_frameworksap_bs_fnd_747cpe:2.3:a:sap:shared_service_framework:sap_bs_fnd_747:*:*:*:*:*:*:*
sapshared_service_frameworksap_bs_fnd_748cpe:2.3:a:sap:shared_service_framework:sap_bs_fnd_748:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	shared_service_framework	sap_bs_fnd_702	cpe:2.3:a:sap:shared_service_framework:sap_bs_fnd_702:::::::*
sap	shared_service_framework	sap_bs_fnd_731	cpe:2.3:a:sap:shared_service_framework:sap_bs_fnd_731:::::::*
sap	shared_service_framework	sap_bs_fnd_746	cpe:2.3:a:sap:shared_service_framework:sap_bs_fnd_746:::::::*
sap	shared_service_framework	sap_bs_fnd_747	cpe:2.3:a:sap:shared_service_framework:sap_bs_fnd_747:::::::*
sap	shared_service_framework	sap_bs_fnd_748	cpe:2.3:a:sap:shared_service_framework:sap_bs_fnd_748:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP Shared Service Framework",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "SAP_BS_FND 702"
      },
      {
        "status": "affected",
        "version": "731"
      },
      {
        "status": "affected",
        "version": "746"
      },
      {
        "status": "affected",
        "version": "747"
      },
      {
        "status": "affected",
        "version": "748"
      }
    ]
  }
]

References

me.sap.com/notes/3474590

url.sap/sapsecuritypatchday

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

18.8%

JSON

Related for CVE-2024-42376