← Back

CVE-2024-45282

nvd nist
Published: Oct 8, 2024Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an OData entity representing assumably immutable method is not protected against external modifications leading to integrity violations. Confidentiality and Availability are not impacted.

Affected (6)

Products: Sap: S/4 Hana
Sap
1 product
S/4 Hana
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Sap
S/4 Hana
Version 102
S/4 Hana
Version 103
S/4 Hana
Version 104
S/4 Hana
Version 105
S/4 Hana
Version 106
S/4 Hana
Version 107

Related CWEs

CWE-650
Trusting HTTP Permission Methods on the Server Side
The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.

References (2)

Source: cna@sap.com
Permissions Required
Source: cna@sap.com
Vendor Advisory

Timeline

No history available yet.