7.7

CVE-2024-39592

Medienbericht

Elements of PDCE does not perform necessary
authorization checks for an authenticated user, resulting in escalation of
privileges.



This
allows an attacker to read sensitive information causing high impact on the
confidentiality of the application.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ S4core Version102
SAP ≫ S4core Version103
SAP ≫ S4coreop Version104
SAP ≫ S4coreop Version105
SAP ≫ S4coreop Version106
SAP ≫ S4coreop Version107
SAP ≫ S4coreop Version108
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.485
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cna@sap.com 7.7 3.1 4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://me.sap.com/notes/3483344
Permissions Required