CVE-2024-32731

Missing Authorization check in SAP My Travel Requests

CVSS 5.5 MEDIUMEPSS 0.4%CWE-862

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

14 mai 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker can upload a malicious attachment to a business trip request which will lead to a low impact on the confidentiality, integrity and availability of the application.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Produtos afetados

SAP_SE · SAP My Travel Requests

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://me.sap.com/notes/3447467 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364