SapCVELIST:CVE-2024-32731CVE-2024-32731 Missing Authorization check in SAP My Travel Requests
5.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
0.0004 Low
EPSS
Percentile
9.1%
SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker can upload a malicious attachment to a business trip request which will lead to a low impact on the confidentiality, integrity and availability of the application.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "SAP My Travel Requests ",
"vendor": "SAP_SE",
"versions": [
{
"status": "affected",
"version": "600"
}
]
}
]
5.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
0.0004 Low
EPSS
Percentile
9.1%