CVE-2024-32730

{"id": "CVE-2024-32730", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-05-14T15:37:02.953", "references": [{"url": "https://me.sap.com/notes/3441944", "source": "cna@sap.com"}, {"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role 'Learner' could gain access to other user's data in manager which will lead to a high impact to the confidentiality of the application.\n\n"}, {"lang": "es", "value": "SAP Enable Now Manager no realiza las comprobaciones de autorizaci\u00f3n necesarias para un usuario autenticado, lo que da lugar a una escalada de privilegios. Si la explotaci\u00f3n tiene \u00e9xito, el atacante con el rol de \"Aprendiz\" podr\u00eda obtener acceso a los datos de otros usuarios en el administrador, lo que tendr\u00e1 un alto impacto en la confidencialidad de la aplicaci\u00f3n."}], "lastModified": "2024-05-14T16:12:23.490", "sourceIdentifier": "cna@sap.com"}