CVE-2024-34690: Missing Authorization check in SAP Student Life Cycle Management (SLcM)

Published Jun 11, 2024

Updated

SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to access and edit non-sensitive report variants that are typically restricted, causing minimal impact on the confidentiality and integrity of the application.

Affected Software

9 affected components

SAP Student Life Cycle Management=618

SAP Student Life Cycle Management=802

SAP Student Life Cycle Management=803

SAP Student Life Cycle Management=804

SAP Student Life Cycle Management=805

SAP Student Life Cycle Management=806

SAP Student Life Cycle Management=807

SAP Student Life Cycle Management=808

SAP Student Life Cycle Management=is-ps-ca_617

Remediation

Patch Available

https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Event History

Jun 11, 2024

CVE Published

via MITRE·02:17 AM

Data Sourced

via MITRE·02:17 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-34690?

CVE-2024-34690 has a high severity due to the potential for privilege escalation.

How do I fix CVE-2024-34690?

To fix CVE-2024-34690, apply the latest security patches provided by SAP for the affected versions of Student Life Cycle Management.

What software versions are impacted by CVE-2024-34690?

CVE-2024-34690 affects SAP Student Life Cycle Management versions 618 through 808 and is-ps-ca_617.

What are the potential risks of CVE-2024-34690?

An attacker exploiting CVE-2024-34690 could gain unauthorized access to and modify non-sensitive report variants.

Is user authentication sufficient in CVE-2024-34690?

No, user authentication alone is not sufficient in CVE-2024-34690 as it fails to implement proper authorization checks.