deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-30207
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). The affected systems use symmetric cryptography with a hard-coded key to protect the communication between client and server. This could allow an unauthenticated remote attacker to compromise confidentiality and integrity of the communication and, subsequently, availability of the system.
A successful exploit requires the attacker to gain knowledge of the hard-coded key and to be able to intercept the communication between client and server on the network.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-321
References: https://cert-portal.siemens.com/productcert/html/ssa-093430.html; https://cert-portal.siemens.com/productcert/html/ssa-093430.html
CVE: CVE-2024-30208
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). The "DBTest"  tool of SIMATIC RTLS Locating Manager does not properly enforce access restriction. This could allow an authenticated local attacker to extract sensitive information from memory.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-732
References: https://cert-portal.siemens.com/productcert/html/ssa-093430.html; https://cert-portal.siemens.com/productcert/html/ssa-093430.html
CVE: CVE-2024-30209
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected systems transmit client-side resources without proper cryptographic protection. This could allow an attacker to eavesdrop on and modify resources in transit. A successful exploit requires an attacker to be in the network path between the RTLS Locating Manager server and a client (MitM).
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-319
References: https://cert-portal.siemens.com/productcert/html/ssa-093430.html; https://cert-portal.siemens.com/productcert/html/ssa-093430.html
CVE: CVE-2024-31484
Published: 2024-05-14
Description: A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-170
References: http://seclists.org/fulldisclosure/2024/Jul/4; https://cert-portal.siemens.com/productcert/html/ssa-620338.html; https://cert-portal.siemens.com/productcert/html/ssa-871704.html
CVE: CVE-2024-31485
Published: 2024-05-14
Description: A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.30), SICORE Base system (All versions < V1.3.0). The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: http://seclists.org/fulldisclosure/2024/Jul/4; https://cert-portal.siemens.com/productcert/html/ssa-871704.html; http://seclists.org/fulldisclosure/2024/Jul/4
CVE: CVE-2024-31486
Published: 2024-05-14
Description: A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30). The affected devices stores MQTT client passwords without sufficient protection on the devices.  An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312
References: http://seclists.org/fulldisclosure/2024/Jul/4; https://cert-portal.siemens.com/productcert/html/ssa-871704.html; http://seclists.org/fulldisclosure/2024/Jul/4
CVE: CVE-2024-31980
Published: 2024-05-14
Description: A vulnerability has been identified in Parasolid V35.1 (All versions < V35.1.256), Parasolid V36.0 (All versions < V36.0.210), Parasolid V36.1 (All versions < V36.1.185). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted X_T part file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-23468)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-489698.html; https://cert-portal.siemens.com/productcert/html/ssa-489698.html
CVE: CVE-2024-32055
Published: 2024-05-14
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-064222.html; https://cert-portal.siemens.com/productcert/html/ssa-976324.html; https://cert-portal.siemens.com/productcert/html/ssa-064222.html
CVE: CVE-2024-32057
Published: 2024-05-14
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains a type confusion vulnerability while parsing IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21562)
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://cert-portal.siemens.com/productcert/html/ssa-064222.html; https://cert-portal.siemens.com/productcert/html/ssa-976324.html; https://cert-portal.siemens.com/productcert/html/ssa-064222.html
CVE: CVE-2024-32058
Published: 2024-05-14
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application is vulnerable to memory corruption while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21563)
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://cert-portal.siemens.com/productcert/html/ssa-064222.html; https://cert-portal.siemens.com/productcert/html/ssa-976324.html; https://cert-portal.siemens.com/productcert/html/ssa-064222.html
CVE: CVE-2024-32059
Published: 2024-05-14
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21564)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-064222.html; https://cert-portal.siemens.com/productcert/html/ssa-976324.html; https://cert-portal.siemens.com/productcert/html/ssa-064222.html
CVE: CVE-2024-32060
Published: 2024-05-14
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21565)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-064222.html; https://cert-portal.siemens.com/productcert/html/ssa-976324.html; https://cert-portal.siemens.com/productcert/html/ssa-064222.html
CVE: CVE-2024-32061
Published: 2024-05-14
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21566)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-064222.html; https://cert-portal.siemens.com/productcert/html/ssa-976324.html; https://cert-portal.siemens.com/productcert/html/ssa-064222.html
CVE: CVE-2024-32062
Published: 2024-05-14
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains a type confusion vulnerability while parsing IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21568)
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://cert-portal.siemens.com/productcert/html/ssa-064222.html; https://cert-portal.siemens.com/productcert/html/ssa-976324.html; https://cert-portal.siemens.com/productcert/html/ssa-064222.html
CVE: CVE-2024-32063
Published: 2024-05-14
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains a type confusion vulnerability while parsing IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21573)
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://cert-portal.siemens.com/productcert/html/ssa-064222.html; https://cert-portal.siemens.com/productcert/html/ssa-976324.html; https://cert-portal.siemens.com/productcert/html/ssa-064222.html
CVE: CVE-2024-32064
Published: 2024-05-14
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21575)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-064222.html; https://cert-portal.siemens.com/productcert/html/ssa-976324.html; https://cert-portal.siemens.com/productcert/html/ssa-064222.html
CVE: CVE-2024-32065
Published: 2024-05-14
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21577)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-064222.html; https://cert-portal.siemens.com/productcert/html/ssa-976324.html; https://cert-portal.siemens.com/productcert/html/ssa-064222.html
CVE: CVE-2024-32066
Published: 2024-05-14
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21578)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-064222.html; https://cert-portal.siemens.com/productcert/html/ssa-976324.html; https://cert-portal.siemens.com/productcert/html/ssa-064222.html
CVE: CVE-2024-32077
Published: 2024-05-14
Description: Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. 
Users are recommended to upgrade to version 2.9.1, which fixes this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2024/05/14/1; https://github.com/apache/airflow/pull/38882; https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
CVE: CVE-2024-32349
Published: 2024-05-14
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mtu" parameters in the "cstecgi.cgi" binary.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-77
References: https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md; https://www.totolink.net/; https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md
CVE: CVE-2024-32350
Published: 2024-05-14
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecPsk" parameter in the "cstecgi.cgi" binary.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md; https://www.totolink.net/; https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md
CVE: CVE-2024-32351
Published: 2024-05-14
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mru" parameter in the "cstecgi.cgi" binary.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md; https://www.totolink.net/; https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md
CVE: CVE-2024-32352
Published: 2024-05-14
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecL2tpEnable" parameter in the "cstecgi.cgi" binary.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md; https://www.totolink.net/; https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md
CVE: CVE-2024-32353
Published: 2024-05-14
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSServer function at /cgi-bin/cstecgi.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md; https://www.totolink.net/; https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md
CVE: CVE-2024-32354
Published: 2024-05-14
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'timeout' parameter in the setSSServer function at /cgi-bin/cstecgi.cgi.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-77
References: https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md; https://www.totolink.net/; https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md
CVE: CVE-2024-32355
Published: 2024-05-14
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setSSServer function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md; https://www.totolink.net/; https://github.com/1s1and123/Vulnerabilities/blob/main/device/ToToLink/X5000R/TOTOLink_X5000R_RCE.md
CVE: CVE-2024-32635
Published: 2024-05-14
Description: A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.10), Teamcenter Visualization V2312 (All versions < V2312.0005). The affected applications contain an out of bounds read past the unmapped memory region while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-046364.html; https://cert-portal.siemens.com/productcert/html/ssa-856475.html; https://cert-portal.siemens.com/productcert/html/ssa-046364.html
CVE: CVE-2024-32636
Published: 2024-05-14
Description: A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.10), Teamcenter Visualization V2312 (All versions < V2312.0005). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-046364.html; https://cert-portal.siemens.com/productcert/html/ssa-856475.html; https://cert-portal.siemens.com/productcert/html/ssa-046364.html
CVE: CVE-2024-32637
Published: 2024-05-14
Description: A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.10), Teamcenter Visualization V2312 (All versions < V2312.0005). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted X_T files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://cert-portal.siemens.com/productcert/html/ssa-046364.html; https://cert-portal.siemens.com/productcert/html/ssa-856475.html; https://cert-portal.siemens.com/productcert/html/ssa-046364.html
CVE: CVE-2024-32639
Published: 2024-05-14
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0011). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted MODEL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-22974)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-923361.html; https://cert-portal.siemens.com/productcert/html/ssa-923361.html
CVE: CVE-2024-32731
Published: 2024-05-14
Description: 
SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker can upload a malicious attachment to a business trip request which will lead to a low impact on the confidentiality, integrity and availability of the application. 


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3447467; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364; https://me.sap.com/notes/3447467
CVE: CVE-2024-32733
Published: 2024-05-14
Description: 
Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject malicious JavaScript code into the dynamically crafted web page. On successful exploitation the attacker can access or modify sensitive information with no impact on availability of the application


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3450286; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364; https://me.sap.com/notes/3450286
CVE: CVE-2024-32740
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains undocumented users and credentials. An attacker could misuse the credentials to compromise the device
locally or over the network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://cert-portal.siemens.com/productcert/html/ssa-273900.html; https://cert-portal.siemens.com/productcert/html/ssa-273900.html
CVE: CVE-2024-32741
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains hard coded password which is used for the privileged system user `root` and for the boot loader `GRUB` by default . An attacker who manages to crack the password hash gains root access to the device.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-259
References: https://cert-portal.siemens.com/productcert/html/ssa-273900.html; https://cert-portal.siemens.com/productcert/html/ssa-273900.html
CVE: CVE-2024-32742
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains an unrestricted USB port. An attacker with local access to the device could potentially misuse the port for booting another operating system and gain complete read/write access to the filesystem.
CVSS Score: 7.6 (HIGH)
CWE: CWE-1326
References: https://cert-portal.siemens.com/productcert/html/ssa-273900.html; https://cert-portal.siemens.com/productcert/html/ssa-273900.html
CVE: CVE-2024-32977
Published: 2024-05-14
Description: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the `autologinLocal` option is enabled within `config.yaml`, even if they come from networks that are not configured as `localNetworks`, spoofing their IP via the `X-Forwarded-For` header. If autologin is not enabled, this vulnerability does not have any impact. The vulnerability has been patched in version 1.10.1. Until the patch has been applied, OctoPrint administrators who have autologin enabled on their instances should disable it and/or to make the instance inaccessible from potentially hostile networks like the internet.
CVSS Score: 7.1 (HIGH)
CWE: CWE-290, CWE-290
References: https://github.com/OctoPrint/OctoPrint/commit/5afbec8d23508edc25b0f1bdef[PII_REDACTED]add4; https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-2vjq-hg5w-5gm7; https://github.com/OctoPrint/OctoPrint/commit/5afbec8d23508edc25b0f1bdef[PII_REDACTED]add4
CVE: CVE-2024-33000
Published: 2024-05-14
Description: SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality to the system.
CVSS Score: 3.5 (LOW)
CWE: CWE-862
References: https://me.sap.com/notes/3392049; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3392049