CVE-2024-28167

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP Group Reporting Data Collection (Enter Package Data)	S4CORE 104; S4CORE 105; S4CORE 106; S4CORE 107; S4CORE 108; SAP_GRDC_CLOUD 1.0.0
sap_se	sap_group_reporting_data_collection	s4core_104; s4core_105; s4core_106; s4core_107; s4core_108; sap_grdc_cloud_1.0.0

References

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-281687.5Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graph CVE-2024-281695.4Cleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticat CVE-2024-28176.5A vulnerability, which was classified as problematic, has been found in Tenda AC15 15.03.05.18. Affected by this issue is the function fromS CVE-2024-281705.5Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable information disclosu CVE-2024-281718.1It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exis CVE-2024-281727.3Uncontrolled search path for some Intel(R) Trace Analyzer and Collector software before version 2022.1 may allow an authenticated user to po CVE-2024-281734.3In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed CVE-2024-281745.8In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly CVE-2024-281755.4Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in CVE-2024-281765.9jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSO CVE-2024-281799.8Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated we CVE-2024-28186.5An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versio