Medium severity · published Jun 11, 2024
CVE-2024-37176
Missing Authorization check in SAP BW/4HANA Transformation and DTP
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
SAP BW/4HANA Transformation and Data Transfer
Process (DTP) allows an authenticated attacker to gain higher access levels
than they should have by exploiting improper authorization checks. This results
in escalation of privileges. It has no impact on the confidentiality of data
but may have low impacts on the integrity and availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
SAP BW/4HANA Transformation and Data Transfer Process · SAP_SE
DW4CORE 200; 300; 400; 796; SAP_BW 740; 750; +8 more · source: vendor
BW
Bw/4hana · Sap
300; 400; 750; 751; 752; 753; +8 more · source: NVD
SB
Sap BW · Sap SE
750; 751; 752; 753; 754; 755; +3 more · source: CISA
SB
Sap BW 4hana · Sap SE
dw4core200; 300; 400; 796; sap_bw_740 · source: CISA
Affected product
SB
SAP BW/4HANA Transformation and Data Transfer Process
SAP_SE