« Volver al listado

CVE-2024-39592

Estado: ModificadaMedia (6.5)—

Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

This allows an attacker to read sensitive information causing high impact on the confidentiality of the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

SAP — S4coreSAP — S4coreop

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-39592",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-39592",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-24T18:22:20.617499Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP PDCE",
          "versions": [
            {
              "status": "affected",
              "version": "S4CORE 102"
            },
            {
              "status": "affected",
              "version": "S4CORE 103"
            },
            {
              "status": "affected",
              "version": "S4COREOP 104"
            },
            {
              "status": "affected",
              "version": "S4COREOP 105"
            },
            {
              "status": "affected",
              "version": "S4COREOP 106"
            },
            {
              "status": "affected",
              "version": "S4COREOP 107"
            },
            {
              "status": "affected",
              "version": "S4COREOP 108"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:sap_se:sap_pdce:*:*:*:*:*:*:*:*"
          ],
          "vendor": "sap_se",
          "product": "sap_pdce",
          "versions": [
            {
              "status": "affected",
              "version": "S4CORE 102"
            },
            {
              "status": "affected",
              "version": "S4CORE 103"
            },
            {
              "status": "affected",
              "version": "S4COREOP 104"
            },
            {
              "status": "affected",
              "version": "S4COREOP 105"
            },
            {
              "status": "affected",
              "version": "S4COREOP 106"
            },
            {
              "status": "affected",
              "version": "S4COREOP 107"
            },
            {
              "status": "affected",
              "version": "S4COREOP 108"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-07-09T04:15:13.420",
  "references": [
    {
      "url": "https://me.sap.com/notes/3483344",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://me.sap.com/notes/3483344",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Elements of PDCE does not perform necessary\nauthorization checks for an authenticated user, resulting in escalation of\nprivileges.\n\n\n\nThis\nallows an attacker to read sensitive information causing high impact on the\nconfidentiality of the application."
    },
    {
      "lang": "es",
      "value": "Elements of PDCE no realiza las verificaciones de autorización necesarias para un usuario autenticado, lo que resulta en una escalada de privilegios. Esto permite a un atacante leer información confidencial causando un alto impacto en la confidencialidad de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T07:42:17.573",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04C95A73-48EB-446C-A5F0-20E1D6BC1779"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C3C9003-68A6-4886-8979-9B7D01A35E40"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4coreop:104:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "666D246E-3DF3-494C-8BD6-6C2F7C0D78C3"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4coreop:105:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6B6F939-A3CD-4C0C-A6E7-E3BD4ADB5288"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4coreop:106:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02AEDF75-D0D4-4221-BB40-9A8DC51FA84D"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4coreop:107:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81ABE589-A7D1-42EF-B5A9-A94C8D0AE3AF"
            },
            {
              "criteria": "cpe:2.3:a:sap:s4coreop:108:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C1E9400-4CEB-4185-BC03-72B7F59DF03C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}