CVE-2024-42376

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. On successful exploitation, an attacker can cause a high impact on confidentiality of the application.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP Shared Service Framework	SAP_BS_FND 702; 731; 746; 747; 748

References

https://me.sap.com/notes/3474590Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-423774.3SAP shared service framework allows an authenticated non-administrative user to call a remote-enabled function, which will allow them to ins CVE-2024-423786.1Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, pote CVE-2024-42388.8A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this vulnerability is the function formSetDev CVE-2024-423804.3The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specif CVE-2024-423818.3os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve CVE-2024-423839.8Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory sp CVE-2024-423847.5Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and pr CVE-2024-423857.0Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if t CVE-2024-423867.5Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet an CVE-2024-423875.3Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet an CVE-2024-423885.3Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet an CVE-2024-423895.3Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet an