CVE-2024-42373

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-42373
SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to delete non-sensitive report variants that are typically restricted, causing minimal impact on the integrity of the application.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://me.sap.com/notes/3479293 Permissions Required
https://url.sap/sapsecuritypatchday Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:student_life_cycle_management:617:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:618:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:802:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:803:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:804:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:805:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:806:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:807:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:808:*:*:*:*:*:*:*
History

12 Sep 2024, 13:26

Type Values Removed Values Added
References () https://me.sap.com/notes/3479293 - () https://me.sap.com/notes/3479293 - Permissions Required
References () https://url.sap/sapsecuritypatchday - () https://url.sap/sapsecuritypatchday - Vendor Advisory
First Time Sap
Sap student Life Cycle Management
CVSS v2 : unknown
v3 : 4.3 		v2 : unknown
v3 : 5.4
CPE cpe:2.3:a:sap:student_life_cycle_management:804:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:807:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:802:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:806:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:803:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:805:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:617:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:808:*:*:*:*:*:*:*
cpe:2.3:a:sap:student_life_cycle_management:618:*:*:*:*:*:*:*
Summary
  • (es) SAP Student Life Cycle Management (SLcM) no realiza comprobaciones de autorización adecuadas para los usuarios autenticados, lo que genera una posible escalada de privilegios. Si se explota con éxito, podría permitir a un atacante eliminar variantes de informes no confidenciales que normalmente están restringidas, causando un impacto mínimo en la integridad de la aplicación.

13 Aug 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-13 05:15

Updated : 2024-09-12 13:26

NVD link : CVE-2024-42373

Mitre link : CVE-2024-42373

CVE.ORG link : CVE-2024-42373

JSON object : View

Products Affected

sap

  • student_life_cycle_management
CWE
CWE-862

Missing Authorization