Medium severity · published Jul 9, 2024
CVE-2024-39592
Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Elements of PDCE does not perform necessary
authorization checks for an authenticated user, resulting in escalation of
privileges.
This
allows an attacker to read sensitive information causing high impact on the
confidentiality of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S4
S4core · Sap
102; 103 · source: NVD
S4
S4coreop · Sap
104; 105; 106; 107; 108 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39592
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39592
Permissions Required
https://me.sap.com/notes/3483344
Vendor Advisory
https://url.sap/sapsecuritypatchday
More from S4core
9.1
CVE-2021-33701
DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102,…
8.8
CVE-2018-2484
SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0;…
7.3
CVE-2023-35870
When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change…
6.1
CVE-2026-24323
Multiple vulnerabilities in BSP Applications of SAP Document Management System
6.1
CVE-2026-0505
Multiple vulnerabilities in BSP Applications of SAP Document Management System