CVE-2024-37176 Missing Authorization check in SAP BW/4HANA Transformation and DTP
An authenticated attacker can exploit missing authorization checks in SAP BW/4HANA to escalate privileges, potentially modifying data or disrupting availability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-37176?
CVE-2024-37176 is a medium-severity missing authorization vulnerability in SAP_SE SAP BW/4HANA Transformation and Data Transfer Process, published on 11 Jun 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low impacts on the integrity and availability of the application.
Weakness: CWE-862
Which versions are affected by CVE-2024-37176?
It affects 1 product.
Products include Sap Bw\/4hana.
How do I fix CVE-2024-37176?
No fix has been published for CVE-2024-37176 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-37176 being exploited?
There is no known exploitation of CVE-2024-37176 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP BW/4HANA Transformation and Data Transfer Process
Sources
Also known as GHSA-2xhx-vgfw-g59c.