Riskcovery

CVE-2024-45282

HTTP Verb Tampering in SAP S/4 HANA(Manage Bank Statements)

State
Published
Severity
4.3 Medium
Published
Oct 8, 2024
Updated
Oct 9, 2024
Reserved
Aug 26, 2024

Read the record on cve.org

Description

Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an OData entity representing assumably immutable method is not protected against external modifications leading to integrity violations. Confidentiality and Availability are not impacted.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nsap

Weaknesses

  • CWE-650 Trusting HTTP Permission Methods on the Server Side

Affected Products

ProductVersions
SAP S/4 HANA (Manage Bank Statements)SAP_SE
  • S4COREAffected
  • 102Affected
  • 103Affected
  • 104Affected
  • 105Affected
  • 106Affected
  • 107Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.