Lucene search

K
nvd[email protected]NVD:CVE-2024-32730
HistoryMay 14, 2024 - 3:37 p.m.

CVE-2024-32730

2024-05-1415:37:02
CWE-862
web.nvd.nist.gov
2
sap enable now manager
authorization checks
authenticated user
escalation of privileges
learner role
confidentiality

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0

Percentile

9.0%

SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role ‘Learner’ could gain access to other user’s data in manager which will lead to a high impact to the confidentiality of the application.

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0

Percentile

9.0%

Related for NVD:CVE-2024-32730