CVE-2024-45282: sap_se sap s/4 hana (manage bank statements)

Vulnerability summary

CVE-2024-45282 is a medium (CVSS 5.3) vulnerability in sap_se sap s/4 hana (manage bank statements). EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.6% of scored vulnerabilities.

Timeline

1. 08-10-2024
   PublishedVulnerability first disclosed.
2. 09-10-2024
   Last modifiedVulnerability information updated.

Description

Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an OData entity representing assumably immutable method is not protected against external modifications leading to integrity violations. Confidentiality and Availability are not impacted.

• CWE-650Trusting HTTP Permission Methods on the Server SideThe server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.