CVE-2024-34691

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact on integrity and no impact on the confidentiality and availability of the system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-346924.6Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files. These files CVE-2024-346935.3Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_iCVE-2024-346948.1LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) CVE-2024-346956.3WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation pCVE-2024-346964.9GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.2CVE-2024-346976.1FreeScout is a free, self-hosted help desk and shared mailbox. A stored HTML Injection vulnerability has been identified in the Email ReceivCVE-2024-346986.3FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerabCVE-2024-346996.5GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constrCVE-2024-34707.2An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use a deploy key pertaCVE-2024-347015.9CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of CVE-2024-347025.3Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encCVE-2024-347037.5Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit enc