// For flags

CVE-2024-39592

[CVE-2024-39592] Missing Authorization check in SAP PDCE

Severity Score

7.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Elements of PDCE does not perform necessary
authorization checks for an authenticated user, resulting in escalation of
privileges. This
allows an attacker to read sensitive information causing high impact on the
confidentiality of the application.

Elements of PDCE no realiza las verificaciones de autorización necesarias para un usuario autenticado, lo que resulta en una escalada de privilegios. Esto permite a un atacante leer información confidencial causando un alto impacto en la confidencialidad de la aplicación.

Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker to read sensitive information causing high impact on the confidentiality of the application.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-06-26 CVE Reserved
  • 2024-07-09 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-08-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-862: Missing Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sap
Search vendor "Sap"
 S4core
Search vendor "Sap" for product "S4core"
*-
Affected
Sap
Search vendor "Sap"
 S4coreop
Search vendor "Sap" for product "S4coreop"
*-
Affected
Sap Se
Search vendor "Sap Se"
 Sap Pdce
Search vendor "Sap Se" for product "Sap Pdce"
*-
Affected