CVE-2024-42377

Published: Aug 13, 2024Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

SAP shared service framework allows an authenticated non-administrative user to call a remote-enabled function, which will allow them to insert value entries into a non-sensitive table, causing low impact on integrity of the application

Affected (5)

Products: Sap: Shared Service Framework

Sap

1 product

Shared Service Framework

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Sap Shared Service Framework	Version sap_bs_fnd_702
Sap Shared Service Framework	Version sap_bs_fnd_731
Sap Shared Service Framework	Version sap_bs_fnd_746
Sap Shared Service Framework	Version sap_bs_fnd_747
Sap Shared Service Framework	Version sap_bs_fnd_748

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://me.sap.com/notes/3474590

Source: cna@sap.com

Permissions Required

https://url.sap/sapsecuritypatchday

Source: cna@sap.com

Vendor Advisory

Timeline

No history available yet.