Medium severity · published Jan 9, 2024
CVE-2024-21736
Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management)
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
SAP S/4HANA Finance for (Advanced Payment Management) - versions SAPSCORE 128, S4CORE 107, does not perform necessary authorization checks. A function import could be triggered allowing the attacker to create in-house bank accounts leading to low impact on the confidentiality of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SAP S/4HANA Finance (Advanced Payment Management) · SAP_SE
SAPSCORE 128; S4CORE 107 · source: vendor
SF
S/4hana Finance · Sap
107; 128 · source: NVD
Affected product
SS
SAP S/4HANA Finance (Advanced Payment Management)
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21736
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21736
Permissions Required
https://me.sap.com/notes/3260667
Product
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
More from SAP S/4HANA Finance (Advanced Payment Management)
5.4
CVE-2024-37172
[CVE-2024-37172] Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management)