PT-2024-7173 · Sap · Sap S/4Hana

Published 2024-10-07 · Updated 2024-11-14 · CVE-2024-45282

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP S/4HANA (affected versions not specified)

Description The issue is related to the Manage Bank Statement Handler component of the SAP S/4HANA platform. It is caused by the lack of a mechanism to prevent unintended changes to resources when processing requests. This could allow an attacker to modify or delete files. Specifically, fields in the 'read only' state in the Bank Statement Draft of the Manage Bank Statements application can be modified using the MERGE method. This leads to integrity violations, although confidentiality and availability are not impacted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-650

Related Identifiers

BDU:2024-08512

CVE-2024-45282

Affected Products

Sap S/4Hana

References · 10

• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08512 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-45282 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45282 · Vendor Advisory
• https://twitter.com/CVEnew/status/1843496334424191211 · Twitter Post
• https://me.sap.com/notes/3251893 · Note
• https://vuldb.com/?id.279544 · Note
• https://t.me/cvedetector/7306 · Telegram Post
• https://t.me/cvenotify/101723 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2024.html · Note