Medium severity · published May 14, 2024
CVE-2024-4138
Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can enable/disable the sharing rule of other users affecting the integrity of the application. Confidentiality and Availability are not affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SAP S/4 HANA (Manage Bank Statement Reprocessing Rules) · SAP_SE
SAPSCORE 131; S4CORE 105; S4CORE 106; S4CORE107; S4CORE 108 · source: vendor
S4
S\/4hana · Sap
105; 106; 107; 108 · source: CISA
Affected product
SS
SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4138
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4138
me.sap.com
https://me.sap.com/notes/3434666
support.sap.com
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
More from SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)
4.3
CVE-2024-4139
Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)
