CVE-2024-25643 - Missing authorization check in SAP Fiori app (My Overtime Requests)

Back Back to CVE browser

MEDIUM

Missing authorization check in SAP Fiori app (My Overtime Requests)

Published Feb 13, 2024

4.3

MEDIUM

CVSS 3.1

EPSS 0.32%

Description

The SAP Fiori app (My Overtime Request) - version 605, does not perform the necessary authorization checks for an authenticated user which may result in an escalation of privileges. It is possible to manipulate the URLs of data requests to access information that the user should not have access to. There is no impact on integrity and availability.

Affected products

Vendor SAP SE Product SAP Fiori app (My Overtime Requests) Default
unaffected
- Version
  605
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP Fiori app (My Overtime Requests)

unaffected

Version	Status	Constraints
605	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-22959
Advisory
https://me.sap.com/notes/3237638
Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-22959		Advisory
https://me.sap.com/notes/3237638		Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html		Vendor Advisory