PT-2024-19219 · Sap · Sap Fiori Front End Server

Published 2024-03-11 · Updated 2024-03-16 · CVE-2024-22133

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Fiori Front End Server version 605

Description The issue allows altering of approver details on the read-only field when sending leave request information, potentially leading to the creation of requests with incorrect approvers. This could cause low impact on Confidentiality and Integrity with no impact on Availability of the application.

Recommendations For SAP Fiori Front End Server version 605, consider restricting access to the leave request functionality until a patch is available to prevent alteration of approver details. As a temporary workaround, disabling the ability to edit approver details in the read-only field may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-22133

Affected Products

Sap Fiori Front End Server

References · 7

• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22133 · Security Note
• https://twitter.com/RedPacketSec/status/1768942788983316956 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1767423895554973839 · Twitter Post
• https://t.me/cvenotify/73517 · Telegram Post
• https://me.sap.com/notes/3417399 · Note