CVE-2024-44112

Sept. 16, 2024, 2:19 p.m.

4.3
Medium

Description

Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative user could call a remote-enabled function which will allow them to delete non-sensitive entries in a user data table. There is no effect on confidentiality or availability.

Product(s) Impacted

Vendor Product Versions
Sap
  • Oil \%\/ Gas
  • 600, 602, 603, 604, 605, 606, 617, 618, 800, 802, 803, 804, 805, 806, 807

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-862
Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a sap oil_\%\/_gas 600 / / / / / / /
a sap oil_\%\/_gas 602 / / / / / / /
a sap oil_\%\/_gas 603 / / / / / / /
a sap oil_\%\/_gas 604 / / / / / / /
a sap oil_\%\/_gas 605 / / / / / / /
a sap oil_\%\/_gas 606 / / / / / / /
a sap oil_\%\/_gas 617 / / / / / / /
a sap oil_\%\/_gas 618 / / / / / / /
a sap oil_\%\/_gas 800 / / / / / / /
a sap oil_\%\/_gas 802 / / / / / / /
a sap oil_\%\/_gas 803 / / / / / / /
a sap oil_\%\/_gas 804 / / / / / / /
a sap oil_\%\/_gas 805 / / / / / / /
a sap oil_\%\/_gas 806 / / / / / / /
a sap oil_\%\/_gas 807 / / / / / / /

References

https://me.sap.com/notes/3505293
https://url.sap/sapsecuritypatchday

Tags

CWE-862
cna@sap.com
2024-09-10
CVE-2024-44112

CVSS Score

4.3 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: LOW
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

    View Vector String

Timeline

Published: Sept. 10, 2024, 4:15 a.m.
Last Modified: Sept. 16, 2024, 2:19 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cna@sap.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.