CVE-2024-28167
MEDIUMSAP Group Reporting Data Collection - Privilege Escalation
Title source: llmDescription
SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.
References (2)
Core 2
Core References
Vendor Advisory
https://me.sap.com/notes/3442378
Scores
CVSS v3
6.5
EPSS
0.0008
EPSS Percentile
22.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-862
Status
published
Products (6)
SAP_SE/SAP Group Reporting Data Collection (Enter Package Data)
S4CORE 104
SAP_SE/SAP Group Reporting Data Collection (Enter Package Data)
S4CORE 105
SAP_SE/SAP Group Reporting Data Collection (Enter Package Data)
S4CORE 106
SAP_SE/SAP Group Reporting Data Collection (Enter Package Data)
S4CORE 107
SAP_SE/SAP Group Reporting Data Collection (Enter Package Data)
S4CORE 108
SAP_SE/SAP Group Reporting Data Collection (Enter Package Data)
SAP_GRDC_CLOUD 1.0.0
Published
Apr 09, 2024
Tracked Since
Feb 18, 2026