CVE-2024-21735
Last modified
CVE-2024-21735 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. SAP LT Replication Server - version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary authorization checks. This could allow an attacker with high privileges to perform unintended actions, resulting in escalation of privileges, which has High impact on confidentiality, integrity and availability of the system. . EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
SAP LT Replication Server - version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary authorization checks. This could allow an attacker with high privileges to perform unintended actions, resulting in escalation of privileges, which has High impact on confidentiality, integrity and availability of the system.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Lt Replication Server | s4core_103 |
| Sap | Lt Replication Server | s4core_104 |
| Sap | Lt Replication Server | s4core_105 |
| Sap | Lt Replication Server | s4core_106 |
| Sap | Lt Replication Server | s4core_107 |
| Sap | Lt Replication Server | s4core_108 |
References
- https://me.sap.com/notes/3407617Permissions Required
- https://me.sap.com/notes/3407617Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-21735?
How severe is CVE-2024-21735?
How do I fix CVE-2024-21735?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-2173Out of bounds memory access in V8 in Google Chrome prior to …8.8
- CVE-2024-21730The fancyselect list field layout does not correctly escape …5.4
- CVE-2024-21731Improper handling of input could lead to an XSS vector in th…6.1
- CVE-2024-21732FlyCms through abbaa5a allows XSS via the permission managem…6.1
- CVE-2024-21733Generation of Error Message Containing Sensitive Information…5.3
- CVE-2024-21734SAP Marketing (Contacts App) - version 160, allows an attack…5.4
- CVE-2024-21736SAP S/4HANA Finance for (Advanced Payment Management) - vers…6.5
- CVE-2024-21737In SAP Application Interface Framework File Adapter - versio…9.1
- CVE-2024-21738SAP NetWeaver ABAP Application Server and ABAP Platform do n…5.4
- CVE-2024-21739Geehy APM32F103CCT6, APM32F103RCT6, APM32F103RCT7, and APM32…5.3
- CVE-2024-2174Inappropriate implementation in V8 in Google Chrome prior to…8.8
- CVE-2024-21740Artery AT32F415CBT7 and AT32F421C8T7 devices have Incorrect …7.4
Are you affected by CVE-2024-21735?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST