CVE-2024-32730

Missing authorization check in SAP Enable Now Manager

CVSS 6.5 MEDIUMEPSS 0.6%CWE-862

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.5EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

26 abr 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role 'Learner' could gain access to other user's data in manager which will lead to a high impact to the confidentiality of the application.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

SAP_SE · SAP Enable Now

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://me.sap.com/notes/3441944 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364