CVE-2024-37176: Missing Authorization check in SAP BW/4HANA Transformation and DTP

Published Jun 11, 2024

Updated

SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low impacts on the integrity and availability of the application.

Affected Software

14 affected components

SAP Bw\/4hana=300

SAP Bw\/4hana=400

SAP Bw\/4hana=750

SAP Bw\/4hana=751

SAP Bw\/4hana=752

SAP Bw\/4hana=753

SAP Bw\/4hana=754

SAP Bw\/4hana=755

SAP Bw\/4hana=756

SAP Bw\/4hana=757

SAP Bw\/4hana=758

SAP Bw\/4hana=796

SAP Bw\/4hana=dw4core_200

SAP Bw\/4hana=sap_bw_740

Remediation

Patch Available

https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Event History

Jun 11, 2024

CVE Published

via MITRE·02:14 AM

Data Sourced

via MITRE·02:14 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-37176?

CVE-2024-37176 is classified as a high-severity vulnerability due to its potential for privilege escalation.

How do I fix CVE-2024-37176?

To mitigate CVE-2024-37176, it is essential to apply the latest security patches provided by SAP for affected versions of BW/4HANA.

Who is affected by CVE-2024-37176?

CVE-2024-37176 affects authenticated users of SAP BW/4HANA versions 300, 400, and various patches up to 758.

What type of vulnerability is CVE-2024-37176?

CVE-2024-37176 is an improper authorization vulnerability that allows for privilege escalation.

Does CVE-2024-37176 affect data confidentiality?

CVE-2024-37176 does not impact the confidentiality of data, but it does pose a risk of unauthorized access levels.