VulnerabilityModified
CVE-2024-37175
SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges.
MEDIUM 6.5EPSS 0.30%
Does this matter?
Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.
Description
SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to access some sensitive information.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.30% probability · 23th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- sap/customer relationship management s4fnd · sap/customer relationship management webclient ui
- Source
- cna@sap.com
References
- https://me.sap.com/notes/3467377Permissions Required
- https://url.sap/sapsecuritypatchdayVendor Advisory
- https://me.sap.com/notes/3467377Permissions Required
- https://url.sap/sapsecuritypatchdayVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.