« Volver al listado

CVE-2026-24314

Estado: AnalizadaMedia (4.3)—

Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

SAP — S/4hana Uiapfi70SAP — S/4hana Uis4h

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-24314",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-24314",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-24T16:30:23.530917Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "S/4HANA (Manage Payment Media)",
          "versions": [
            {
              "status": "affected",
              "version": "UIAPFI70 600"
            },
            {
              "status": "affected",
              "version": "700"
            },
            {
              "status": "affected",
              "version": "800"
            },
            {
              "status": "affected",
              "version": "900"
            },
            {
              "status": "affected",
              "version": "901"
            },
            {
              "status": "affected",
              "version": "902"
            },
            {
              "status": "affected",
              "version": "UIS4H 109"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-24T06:16:35.270",
  "references": [
    {
      "url": "https://me.sap.com/notes/3646297",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-497"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted."
    },
    {
      "lang": "es",
      "value": "Bajo ciertas condiciones, SAP S/4HANA (Gestionar Medios de Pago) permite a un atacante autenticado acceder a información que de otro modo estaría restringida. Esto podría causar un impacto bajo en la confidencialidad de la aplicación, mientras que la integridad y la disponibilidad no se ven impactadas."
    }
  ],
  "lastModified": "2026-06-17T10:22:53.260",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana_uiapfi70:600:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9AB97C06-5D56-470C-8B8F-3C782E1F70C4"
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana_uiapfi70:700:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "509D6CFA-7A14-428C-B878-9C9C1588ED8F"
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana_uiapfi70:800:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06BDD6A0-C115-427B-876B-4F0C393043DE"
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana_uiapfi70:900:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C05B6F2-C6A8-4FEB-917A-AB2FA86B50BD"
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana_uiapfi70:901:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "186D3DCE-2FE0-4EB9-B9DB-EF7B5F0775E5"
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana_uiapfi70:902:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64DFAF25-C968-40A5-96EA-4B163CA21897"
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana_uis4h:109:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1C5F869-886A-4E07-81EB-B9DD4BE08180"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}