CVE-2024-37172

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SAP S/4HANA Finance (Advanced Payment Management) does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality and availability but there is no impact on the integrity.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP S/4HANA Finance (Advanced Payment Management)	S4CORE 107; S4CORE 108

References

https://me.sap.com/notes/3457354Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory
https://me.sap.com/notes/3457354Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory

Timeline

Published: Jul 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-371736.1Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicio CVE-2024-371746.1Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vuln CVE-2024-371756.5SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This coul CVE-2024-371765.4SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should h CVE-2024-371778.1SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network CVE-2024-371785.0SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Thes CVE-2024-371796.5SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence CVE-2024-37185.4The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets all CVE-2024-371805.3Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function mo CVE-2024-371812.6Time-of-check time-of-use race condition in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to CVE-2024-371826.1Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to CVE-2024-371837.5Plain text credentials and session ID can be captured with a network sniffer.