TI-2024-22989 Aliases CVE-2024-34690 GHSA-23gf-62w7-q77v

Missing Authorization check in SAP Student Life Cycle Management (SLcM)

LOW 24CWE-862Published 2024-06-11 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to access and edit non-sensitive report variants that are typically restricted, causing minimal impact on the confidentiality and integrity of the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00223 13th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Student Life Cycle Management	IS-PS-CA 617; 618; 802; 803; 804; 805; 806; 807; 808	—	No fix listed	CNA

SAP Student Life Cycle Management VendorSAP Affected IS-PS-CA 617; 618; 802; 803; 804; 805; 806; 807; 808 Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:student_life_cycle_management:618:::::::*	618	Vulnerable	SAP
cpe:2.3:a:sap:student_life_cycle_management:802:::::::*	802	Vulnerable	SAP
cpe:2.3:a:sap:student_life_cycle_management:803:::::::*	803	Vulnerable	SAP
cpe:2.3:a:sap:student_life_cycle_management:804:::::::*	804	Vulnerable	SAP
cpe:2.3:a:sap:student_life_cycle_management:805:::::::*	805	Vulnerable	SAP
cpe:2.3:a:sap:student_life_cycle_management:806:::::::*	806	Vulnerable	SAP
cpe:2.3:a:sap:student_life_cycle_management:807:::::::*	807	Vulnerable	SAP
cpe:2.3:a:sap:student_life_cycle_management:808:::::::*	808	Vulnerable	SAP
cpe:2.3:a:sap:student_life_cycle_management:is-ps-ca_617:::::::*	is-ps-ca_617	Vulnerable	SAP

cpe:2.3:a:sap:student_life_cycle_management:618:*:*:*:*:*:*:* Versions 618 Vulnerable ·SAP
cpe:2.3:a:sap:student_life_cycle_management:802:*:*:*:*:*:*:* Versions 802 Vulnerable ·SAP
cpe:2.3:a:sap:student_life_cycle_management:803:*:*:*:*:*:*:* Versions 803 Vulnerable ·SAP
cpe:2.3:a:sap:student_life_cycle_management:804:*:*:*:*:*:*:* Versions 804 Vulnerable ·SAP
cpe:2.3:a:sap:student_life_cycle_management:805:*:*:*:*:*:*:* Versions 805 Vulnerable ·SAP
cpe:2.3:a:sap:student_life_cycle_management:806:*:*:*:*:*:*:* Versions 806 Vulnerable ·SAP
cpe:2.3:a:sap:student_life_cycle_management:807:*:*:*:*:*:*:* Versions 807 Vulnerable ·SAP
cpe:2.3:a:sap:student_life_cycle_management:808:*:*:*:*:*:*:* Versions 808 Vulnerable ·SAP
cpe:2.3:a:sap:student_life_cycle_management:is-ps-ca_617:*:*:*:*:*:*:* Versions is-ps-ca_617 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-34690
2026-10-03 Alias added: GHSA-23gf-62w7-q77v

References

Patch 1

https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Other 1

https://me.sap.com/notes/3457265

TI-2024-28359 Missing Authorization Check in SAP Student Life Cycle Management (SLcM) CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences