Missing authorization check in SAP BAM (Bank Account Management) (SAP_SE SAP BAM (Bank Account Management))
En bref
- Source
- NVD
- EPSS
- EPSS 0.31 % · centile 24 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Modified
Description
SAP Bank Account Management (BAM) allows an authenticated user with restricted access to use functions which can result in escalation of privileges with low impact on confidentiality, integrity and availability of the application.
Faiblesses (CWE)
- CWE-862 — Autorisation absente
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | sap |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-22138
- GCVE · GCVE-0-2024-24739
Avis du CERT-FR
- CERTFR-2024-AVI-0125 — Multiples vulnérabilités dans SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:bank_account_management:s4core_100:*:*:*:*:*:*:*cpe:2.3:a:sap:bank_account_management:s4core_101:*:*:*:*:*:*:*cpe:2.3:a:sap:bank_account_management:sap_fin_618:*:*:*:*:*:*:*cpe:2.3:a:sap:bank_account_management:sap_fin_730:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP BAM (Bank Account Management) | affected SAP_FIN 618 ; affected SAP_FIN 730 ; affected S4CORE 100 ; affected 101 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |