Missing Authorization check in SAP BW/4HANA Transformation and DTP
Priority LOW 25CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low impacts on the integrity and availability of the application.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00276 20th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP BW/4HANA Transformation and Data Transfer Process | DW4CORE 200; 300; 400; 796; SAP_BW 740; 750; 751; 752; 753; 754; 755; 756; 757; 758 | — | No fix listed | CNA |
- SAP BW/4HANA Transformation and Data Transfer Process VendorSAP Affected DW4CORE 200; 300; 400; 796; SAP_BW 740; 750; 751; 752; 753; 754; 755; 756; 757; 758 Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:bw\/4hana:300:*:*:*:*:*:*:* | 300 | Vulnerable | SAP |
| cpe:2.3:a:sap:bw\/4hana:400:*:*:*:*:*:*:* | 400 | Vulnerable | SAP |
| cpe:2.3:a:sap:bw\/4hana:750:*:*:*:*:*:*:* | 750 | Vulnerable | SAP |
| cpe:2.3:a:sap:bw\/4hana:751:*:*:*:*:*:*:* | 751 | Vulnerable | SAP |
| cpe:2.3:a:sap:bw\/4hana:752:*:*:*:*:*:*:* | 752 | Vulnerable | SAP |
| cpe:2.3:a:sap:bw\/4hana:753:*:*:*:*:*:*:* | 753 | Vulnerable | SAP |
| cpe:2.3:a:sap:bw\/4hana:754:*:*:*:*:*:*:* | 754 | Vulnerable | SAP |
| cpe:2.3:a:sap:bw\/4hana:755:*:*:*:*:*:*:* | 755 | Vulnerable | SAP |
| cpe:2.3:a:sap:bw\/4hana:756:*:*:*:*:*:*:* | 756 | Vulnerable | SAP |
| cpe:2.3:a:sap:bw\/4hana:757:*:*:*:*:*:*:* | 757 | Vulnerable | SAP |
- cpe:2.3:a:sap:bw\/4hana:300:*:*:*:*:*:*:* Versions 300 Vulnerable ·SAP
- cpe:2.3:a:sap:bw\/4hana:400:*:*:*:*:*:*:* Versions 400 Vulnerable ·SAP
- cpe:2.3:a:sap:bw\/4hana:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
- cpe:2.3:a:sap:bw\/4hana:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
- cpe:2.3:a:sap:bw\/4hana:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
- cpe:2.3:a:sap:bw\/4hana:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
- cpe:2.3:a:sap:bw\/4hana:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
- cpe:2.3:a:sap:bw\/4hana:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
- cpe:2.3:a:sap:bw\/4hana:756:*:*:*:*:*:*:* Versions 756 Vulnerable ·SAP
- cpe:2.3:a:sap:bw\/4hana:757:*:*:*:*:*:*:* Versions 757 Vulnerable ·SAP
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:bw\/4hana:758:*:*:*:*:*:*:* | 758 | Vulnerable | SAP |
| cpe:2.3:a:sap:bw\/4hana:796:*:*:*:*:*:*:* | 796 | Vulnerable | SAP |
| cpe:2.3:a:sap:bw\/4hana:dw4core_200:*:*:*:*:*:*:* | dw4core_200 | Vulnerable | SAP |
| cpe:2.3:a:sap:bw\/4hana:sap_bw_740:*:*:*:*:*:*:* | sap_bw_740 | Vulnerable | SAP |
- cpe:2.3:a:sap:bw\/4hana:758:*:*:*:*:*:*:* Versions 758 Vulnerable ·SAP
- cpe:2.3:a:sap:bw\/4hana:796:*:*:*:*:*:*:* Versions 796 Vulnerable ·SAP
- cpe:2.3:a:sap:bw\/4hana:dw4core_200:*:*:*:*:*:*:* Versions dw4core_200 Vulnerable ·SAP
- cpe:2.3:a:sap:bw\/4hana:sap_bw_740:*:*:*:*:*:*:* Versions sap_bw_740 Vulnerable ·SAP
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-37176
- 2026-10-03 Alias added: GHSA-2xhx-vgfw-g59c
References
More SAP Bw/4hana vulnerabilities
- TI-2021-04564 Code injection in SAP Business Warehouse CVSS 3.1HIGH 8.8
- TI-2020-16301 OS command injection in SAP Business Warehouse CVSS 3.1CRITICAL 9.1
- TI-2019-00212 Missing authorization in SAP BW/4HANA CVSS 3.0HIGH 8.8
- TI-2023-16859 Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA CVSS 3.1MEDIUM 6.5
Sources
- CVE-2024-37176 · CVE Program
- CVE-2024-37176 · NVD
- FIRST EPSS
- GHSA-2xhx-vgfw-g59c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences