CVE-2024-4138 MEDIUM

CVE-2024-4138: Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)

Vendor Sap_Se
Product SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)
Weakness CWE-862 · Missing authorization
Published May 14, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can enable/disable the sharing rule of other users affecting the integrity of the application. Confidentiality and Availability are not affected.

Key dates

02Disclosure timeline

May 14, 2024 CVE published
August 1, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-2292 Access Control Vulnerabilities lead to Violation of Privacy and Modification of Personal Data CVE-2025-13812 GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure CVE-2025-46258 WordPress Element Pack Pro Plugin < 8.0.0 - Broken Access Control vulnerability CVE-2025-68511 WordPress Gutenverse Form plugin <= 2.3.1 - Broken Access Control vulnerability CVE-2025-3906 Integração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation