CVE-2024-39592

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

This allows an attacker to read sensitive information causing high impact on the confidentiality of the application.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jul 9, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-395935.7SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. SuccessfCVE-2024-395946.1SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in ReflCVE-2024-395955.4SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in StorCVE-2024-395964.3Due to missing authorization checks, SAP Enable Now allows an author to escalate privileges to access information which should otherwise be CVE-2024-395977.2In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early lCVE-2024-395987.7SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by speciallCVE-2024-395994.7Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured CVE-2024-396004.2Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an attaCVE-2024-396016.5A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1CVE-2024-396029.1An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craCVE-2024-396037.2A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic_mesh() functionality of Wavlink AC3000 M33A8.V5030.210CVE-2024-396048.1A command execution vulnerability exists in the update_filter_url.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted
CVE-2024-39592: Medium severity, CVSS 6.5 | Vulnix