Read the docs
TI-2024-26521 Aliases CVE-2024-39591GHSA-4cwg-vmj9-q8qf

Missing Authorization check in SAP Document Builder

Priority LOW 24CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact on confidentiality of the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Document BuilderS4FND 102; S4FND 103; S4FND 104; S4FND 105; S4FND 106; S4FND 107; S4FND 108; SAP_BS_FND 702; SAP_BS_FND 731; SAP_BS_FND 746; SAP_BS_FND 747; SAP_BS_FND 748—No fix listedCNA
  • SAP Document Builder VendorSAP Affected S4FND 102; S4FND 103; S4FND 104; S4FND 105; S4FND 106; S4FND 107; S4FND 108; SAP_BS_FND 702; SAP_BS_FND 731; SAP_BS_FND 746; SAP_BS_FND 747; SAP_BS_FND 748 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:sap:document_builder:s4fnd_102:*:*:*:*:*:*:*s4fnd_102VulnerableSAP
cpe:2.3:a:sap:document_builder:s4fnd_103:*:*:*:*:*:*:*s4fnd_103VulnerableSAP
cpe:2.3:a:sap:document_builder:s4fnd_104:*:*:*:*:*:*:*s4fnd_104VulnerableSAP
cpe:2.3:a:sap:document_builder:s4fnd_105:*:*:*:*:*:*:*s4fnd_105VulnerableSAP
cpe:2.3:a:sap:document_builder:s4fnd_106:*:*:*:*:*:*:*s4fnd_106VulnerableSAP
cpe:2.3:a:sap:document_builder:s4fnd_107:*:*:*:*:*:*:*s4fnd_107VulnerableSAP
cpe:2.3:a:sap:document_builder:s4fnd_108:*:*:*:*:*:*:*s4fnd_108VulnerableSAP
cpe:2.3:a:sap:document_builder:sap_bs_fnd_702:*:*:*:*:*:*:*sap_bs_fnd_702VulnerableSAP
cpe:2.3:a:sap:document_builder:sap_bs_fnd_731:*:*:*:*:*:*:*sap_bs_fnd_731VulnerableSAP
cpe:2.3:a:sap:document_builder:sap_bs_fnd_746:*:*:*:*:*:*:*sap_bs_fnd_746VulnerableSAP
  • cpe:2.3:a:sap:document_builder:s4fnd_102:*:*:*:*:*:*:* Versions s4fnd_102 Vulnerable ·SAP
  • cpe:2.3:a:sap:document_builder:s4fnd_103:*:*:*:*:*:*:* Versions s4fnd_103 Vulnerable ·SAP
  • cpe:2.3:a:sap:document_builder:s4fnd_104:*:*:*:*:*:*:* Versions s4fnd_104 Vulnerable ·SAP
  • cpe:2.3:a:sap:document_builder:s4fnd_105:*:*:*:*:*:*:* Versions s4fnd_105 Vulnerable ·SAP
  • cpe:2.3:a:sap:document_builder:s4fnd_106:*:*:*:*:*:*:* Versions s4fnd_106 Vulnerable ·SAP
  • cpe:2.3:a:sap:document_builder:s4fnd_107:*:*:*:*:*:*:* Versions s4fnd_107 Vulnerable ·SAP
  • cpe:2.3:a:sap:document_builder:s4fnd_108:*:*:*:*:*:*:* Versions s4fnd_108 Vulnerable ·SAP
  • cpe:2.3:a:sap:document_builder:sap_bs_fnd_702:*:*:*:*:*:*:* Versions sap_bs_fnd_702 Vulnerable ·SAP
  • cpe:2.3:a:sap:document_builder:sap_bs_fnd_731:*:*:*:*:*:*:* Versions sap_bs_fnd_731 Vulnerable ·SAP
  • cpe:2.3:a:sap:document_builder:sap_bs_fnd_746:*:*:*:*:*:*:* Versions sap_bs_fnd_746 Vulnerable ·SAP
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:document_builder:sap_bs_fnd_747:*:*:*:*:*:*:*sap_bs_fnd_747VulnerableSAP
cpe:2.3:a:sap:document_builder:sap_bs_fnd_748:*:*:*:*:*:*:*sap_bs_fnd_748VulnerableSAP
  • cpe:2.3:a:sap:document_builder:sap_bs_fnd_747:*:*:*:*:*:*:* Versions sap_bs_fnd_747 Vulnerable ·SAP
  • cpe:2.3:a:sap:document_builder:sap_bs_fnd_748:*:*:*:*:*:*:* Versions sap_bs_fnd_748 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-39591
  2. 2026-10-03 Alias added: GHSA-4cwg-vmj9-q8qf

References

Advisory 1

Other 1

  • TI-2024-22982 Unrestricted file upload in SAP Document Builder (HTTP service) CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences