CVE-2024-45282 — Trusting HTTP Permission Methods on the Server Side in SE SAP S 4 Hana

CWE-650 — Trusting HTTP Permission Methods on the Server Side3 documents3 sources
Severity
5.3MEDIUMNVD
CNA4.3
EPSS
0.3%
top 49.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP S 4 HanaSAP S 4 Hana
Timeline
PublishedOct 8

Description

Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an OData entity representing assumably immutable method is not protected against external modifications leading to integrity violations. Confidentiality and Availability are not impacted.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDsap/s_4_hana6 versions+5
▶CVEListV5sap_se/sap_s_4_hana7 versions+6

🔴Vulnerability Details

2
CVEList
HTTP Verb Tampering in SAP S/4 HANA(Manage Bank Statements)↗2024-10-08
▶
GHSA
GHSA-3wwx-rqjr-vjcc: Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method↗2024-10-08
▶
CVE-2024-45282 — SAP SE SAP S 4 Hana vulnerability | cvebase