Vulnerability · Published Jul 9, 2024 · Assigned by sap
CVE-2024-39596[CVE-2024-39596] Missing Authorization check vulnerability in SAP Enable Now
Medium 4.3
In plain English
A medium-severity missing authorization in SAP Enable Now from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 81.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Due to missing authorization checks, SAP Enable Now allows an author to escalate privileges to access information which should otherwise be restricted. On successful exploitation, the attacker can cause limited impact on confidentiality of the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Enable Now | WPB_MANAGER_CE 10WPB_MANAGER_HANA 10ENABLE_NOW_CONSUMP_DEL 1704 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N