« Volver al listado

CVE-2026-24312

Estado: AnalizadaMedia (5.2)—

An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by leveraging permissions from a less sensitive function to execute unauthorized, high-privilege actions. This has a high impact on data integrity, with low impact on confidentiality and no impact on availability of the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — SAP Basis

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-24312",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-24312",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-10T17:17:39.457732Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.2,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 0.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.2,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Business Workflow",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_BASIS 752"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 753"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 754"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 755"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 756"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 757"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 758"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 816"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-10T04:16:03.663",
  "references": [
    {
      "url": "https://me.sap.com/notes/3710111",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by leveraging permissions from a less sensitive function to execute unauthorized, high-privilege actions. This has a high impact on data integrity, with low impact on confidentiality and no impact on availability of the application."
    },
    {
      "lang": "es",
      "value": "Una verificación de autorización errónea en SAP Business Workflow conduce a escalada de privilegios. Un usuario administrativo autenticado puede eludir las restricciones de rol aprovechando permisos de una función menos sensible para ejecutar acciones no autorizadas y de alto privilegio. Esto tiene un alto impacto en la integridad de los datos, con bajo impacto en la confidencialidad y sin impacto en la disponibilidad de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T10:22:53.050",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:752:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C121CC9-26F6-4103-8EB0-BAFF6B5B5FE8"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:753:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86086D00-10BF-4C55-8D87-82CCBE468153"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:754:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F25246A-D9E5-4F0D-B91A-478D4E5570DB"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:755:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0218695F-C4AD-46BF-B176-F10C644A9C2D"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:756:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC9E7C3E-1005-450A-9198-E014C1BAADBC"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:757:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A177AB1-CC85-46EF-91DF-462096608C9F"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:758:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7591F81-708C-4285-9BB2-F2B4BDB9759B"
            },
            {
              "criteria": "cpe:2.3:a:sap:sap_basis:816:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF7825FC-2F0F-4096-BE41-67B4DCC4F7DE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}