CVE-2023-24524

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to delete the data with a high impact to availability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-245255.4SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cro CVE-2023-245265.3SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities t CVE-2023-245275.3SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user ide CVE-2023-245286.5SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain m CVE-2023-245296.1Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75 CVE-2023-24538.8There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requir CVE-2023-245309.1SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code th CVE-2023-245319.8Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executi CVE-2023-245325.3The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a CVE-2023-245337.5Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked CVE-2023-245347.5HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of servic CVE-2023-245357.5Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more