CVE-2024-37176

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low impacts on the integrity and availability of the application.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP BW/4HANA Transformation and Data Transfer Process	DW4CORE 200; 300; 400; 796; SAP_BW 740; 750; 751; 752; 753; 754; 755; 756; 757; 758
sap_se	sap_bw_4hana	dw4core200
sap_se	sap_bw_4hana	300
sap_se	sap_bw_4hana	400
sap_se	sap_bw_4hana	796
sap_se	sap_bw_4hana	sap_bw_740
sap_se	sap_bw	750
sap_se	sap_bw	751
sap_se	sap_bw	752
sap_se	sap_bw	753
sap_se	sap_bw	754
sap_se	sap_bw	755
sap_se	sap_bw	756
sap_se	sap_bw	757
sap_se	sap_bw	758

References

https://me.sap.com/notes/3465455Permissions Required
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.htmlPatch, Vendor Advisory
https://me.sap.com/notes/3465455Permissions Required
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.htmlPatch, Vendor Advisory

Timeline

Published: Jun 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-371778.1SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network CVE-2024-371785.0SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Thes CVE-2024-371796.5SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence CVE-2024-37185.4The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets all CVE-2024-371805.3Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function mo CVE-2024-371812.6Time-of-check time-of-use race condition in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to CVE-2024-371826.1Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to CVE-2024-371837.5Plain text credentials and session ID can be captured with a network sniffer.CVE-2024-371847.2A buffer overflow vulnerability exists in the adm.cgi rep_as_bridge() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafte CVE-2024-371859.8in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write.CVE-2024-371867.2An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially c CVE-2024-371875.7Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding.