CVE-2024-42376: Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework
First published: Tue Aug 13 2024(Updated: )
SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. On successful exploitation, an attacker can cause a high impact on confidentiality of the application.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Shared Service Framework | =sap_bs_fnd_702 | |
| SAP Shared Service Framework | =sap_bs_fnd_731 | |
| SAP Shared Service Framework | =sap_bs_fnd_746 | |
| SAP Shared Service Framework | =sap_bs_fnd_747 | |
| SAP Shared Service Framework | =sap_bs_fnd_748 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-42376?
CVE-2024-42376 is classified as a high severity vulnerability due to the potential for privilege escalation.
How do I fix CVE-2024-42376?
To fix CVE-2024-42376, ensure that you apply the latest security patches provided by SAP for the affected versions of the Shared Service Framework.
What versions of SAP Shared Service Framework are affected by CVE-2024-42376?
CVE-2024-42376 affects SAP Shared Service Framework versions sap_bs_fnd_702, sap_bs_fnd_731, sap_bs_fnd_746, sap_bs_fnd_747, and sap_bs_fnd_748.
What is the impact of CVE-2024-42376?
The impact of CVE-2024-42376 is high as it allows authenticated users to escalate their privileges, compromising the application's confidentiality.
Can an attacker exploit CVE-2024-42376 remotely?
Yes, an attacker with authenticated access can exploit CVE-2024-42376 to escalate privileges within the application.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- agent/source
- vendor/sap
- canonical/sap shared service framework
- version/sap shared service framework/sap_bs_fnd_702
- version/sap shared service framework/sap_bs_fnd_731
- version/sap shared service framework/sap_bs_fnd_746
- version/sap shared service framework/sap_bs_fnd_747
- version/sap shared service framework/sap_bs_fnd_748