CVE-2024-37172: [CVE-2024-37172] Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management)

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-09 · updated 2026-06-17
Weakness: CWE-862

Description

SAP S/4HANA Finance (Advanced Payment Management) does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality and availability but there is no impact on the integrity.

Affected products

SAP S4Core: 107, 108

References

https://me.sap.com/notes/3457354
https://url.sap/sapsecuritypatchday
https://me.sap.com/notes/3457354
https://url.sap/sapsecuritypatchday

Get alerted when CVE-2024-37172 or the next vulnerability affects your stack