CVE-2024-39591

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact on confidentiality of the application.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-395926.5Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This a CVE-2024-395935.7SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. Successf CVE-2024-395946.1SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Refl CVE-2024-395955.4SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stor CVE-2024-395964.3Due to missing authorization checks, SAP Enable Now allows an author to escalate privileges to access information which should otherwise be CVE-2024-395977.2In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early l CVE-2024-395987.7SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by speciall CVE-2024-395994.7Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured CVE-2024-396004.2Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an atta CVE-2024-396016.5A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1 CVE-2024-396029.1An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially cra CVE-2024-396037.2A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic_mesh() functionality of Wavlink AC3000 M33A8.V5030.210