CVE-2024-37175

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-37175
SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to access some sensitive information.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://me.sap.com/notes/3467377 Permissions Required
https://url.sap/sapsecuritypatchday Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:customer_relationship_management_s4fnd:102:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:103:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:104:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:105:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:106:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:107:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:108:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:746:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:747:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:748:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:800:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:801:*:*:*:*:*:*:*
History

09 Sep 2024, 15:48

Type Values Removed Values Added
First Time Sap
Sap customer Relationship Management S4fnd
Sap customer Relationship Management Webclient Ui
CPE cpe:2.3:a:sap:customer_relationship_management_s4fnd:103:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:108:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:104:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:106:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:748:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:105:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:800:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:801:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:102:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:747:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_s4fnd:107:*:*:*:*:*:*:*
cpe:2.3:a:sap:customer_relationship_management_webclient_ui:746:*:*:*:*:*:*:*
References () https://me.sap.com/notes/3467377 - () https://me.sap.com/notes/3467377 - Permissions Required
References () https://url.sap/sapsecuritypatchday - () https://url.sap/sapsecuritypatchday - Vendor Advisory
CVSS v2 : unknown
v3 : 4.3 		v2 : unknown
v3 : 6.5

09 Jul 2024, 18:19

Type Values Removed Values Added
Summary
  • (es) SAP CRM WebClient no realiza la verificación de autorización necesaria para un usuario autenticado, lo que resulta en una escalada de privilegios. Esto podría permitir que un atacante acceda a información confidencial.

09 Jul 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-09 05:15

Updated : 2024-09-09 15:48

NVD link : CVE-2024-37175

Mitre link : CVE-2024-37175

CVE.ORG link : CVE-2024-37175

JSON object : View

Products Affected

sap

  • customer_relationship_management_webclient_ui
  • customer_relationship_management_s4fnd
CWE
CWE-862

Missing Authorization