CVE-2024-27900 Missing Authorization check in SAP ABAP Platform
An attacker with a business user account can modify job template privacy settings, restricting access to the owner only.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-27900?
CVE-2024-27900 is a medium-severity missing authorization vulnerability in SAP_SE SAP ABAP Platform, published on 12 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job templates from shared to private. As a result, the selected template would only be accessible to the owner.
Weakness: CWE-862
Which versions are affected by CVE-2024-27900?
It affects 1 product.
Products include Sap Abap Platform.
How do I fix CVE-2024-27900?
No fix has been published for CVE-2024-27900 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-27900 being exploited?
There is no known exploitation of CVE-2024-27900 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP ABAP Platform
- CVE-2021-44231 Code injection in SAP ABAP Server & ABAP Platform (Translation Tools)
- CVE-2024-22131 Code Injection vulnerability in SAP ABA (Application Basis)
- CVE-2020-6318 Code injection in SAP NetWeaver (ABAP Server) and ABAP Platform
- CVE-2020-6296 Code injection in SAP NetWeaver (ABAP Server) and ABAP Platform
- CVE-2023-25615 SQL Injection vulnerability in SAP ABAP Platform
Sources
Also known as GHSA-r7v7-m4x6-4rxm.