VulnerabilityDeferred

CVE-2024-44121

Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted.

MEDIUM 4.3EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted. The vulnerability could expose internal user data that should remain confidential. It does not impact the integrity and availability of the application

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-213
Source: cna@sap.com

References

https://me.sap.com/notes/3437585
https://url.sap/sapsecuritypatchday

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.