PT-2024-22121 · Sap · Sap Abap Platform

Published 2024-03-11 · Updated 2024-03-12 · CVE-2024-27900

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP ABAP Platform versions 758, 795

Description The issue is due to a missing authorization check, allowing an attacker with a business user account to change the privacy setting of job templates from shared to private, making the selected template only accessible to the owner.

Recommendations For version 758, update to a version that includes the necessary authorization checks to prevent unauthorized changes to job template privacy settings. For version 795, apply the same update as for version 758 to ensure proper authorization checks are in place. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-27900

Affected Products

Sap Abap Platform

References · 6

• https://osv.dev/vulnerability/CVE-2024-27900 · Vendor Advisory
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27900 · Security Note
• https://t.me/cvenotify/73520 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1767423389658955886 · Twitter Post
• https://me.sap.com/notes/3419022 · Note