Advisory
On 24.09.2024 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP S/4 HANA.
SAP Note 3251893 addresses "[CVE-2024-45282] HTTP Verb Tampering in SAP S/4 HANA(Manage Bank Statements)" to prevent http verb tampering with a medium risk for exploitation.
A workaround does exist, according to SAP Security Advisory team. It is advisable to implement the correction as none, the team suggests.
Risk specification
Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an OData entity representing assumably immutable method is not protected against external modifications leading to integrity violations. Confidentiality and Availability are not impacted.Solution
As a solution, the respective fields (read only on UI) were restricted to 'read only' directly in the business object in backend, therefore the change of content of these fields is not possible via MERGE method anymore. Please implement the Correction Instructions or Support Packages referenced in this SAP Security Note Circumstances exist that prevent the timely installation of a patch provided by the manufacturer. In such cases, you may consider applying the suggested workaround as a temporary or compensating mitigation: "no workaround available".
The advisory is valid for
- S4CORE 102 48
- S4CORE 103 51
- S4CORE 104 46
- S4CORE 105 34
- S4CORE 106 24
- S4CORE 107 18
