CVE-2024-42373
📋 TL;DR
This vulnerability in SAP Student Life Cycle Management (SLcM) allows authenticated users to bypass authorization checks and delete non-sensitive report variants they shouldn't have access to. It affects organizations using SAP SLcM with insufficient authorization controls. The impact is limited to deleting certain report variants, not core data or system functionality.
💻 Affected Systems
- SAP Student Life Cycle Management (SLcM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could delete multiple report variants, potentially disrupting reporting workflows and requiring restoration from backups.
Likely Case
Minimal operational disruption from deleted report variants that can be recreated or restored.
If Mitigated
No impact if proper authorization controls and monitoring are implemented.
🎯 Exploit Status
Exploitation requires authenticated access to SAP SLcM and knowledge of report variant functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: See SAP Note 3479293 for specific patch details
Vendor Advisory: https://me.sap.com/notes/3479293
Restart Required: Yes
Instructions:
1. Review SAP Note 3479293
2. Apply the relevant SAP Security Patch
3. Restart affected SAP SLcM systems
4. Verify authorization checks are functioning correctly
🔧 Temporary Workarounds
Strengthen Authorization Controls
allImplement additional authorization checks and role-based access controls for report variant management.
Monitor Report Variant Deletions
allEnable detailed logging and monitoring for report variant deletion activities.
🧯 If You Can't Patch
- Implement strict role-based access controls limiting who can manage report variants.
- Enable comprehensive audit logging for all report variant operations and monitor for unauthorized deletions.
🔍 How to Verify
Check if Vulnerable:
Check if your SAP SLcM version matches those listed in SAP Note 3479293 and test authorization controls for report variant deletion.Check Version:
Use SAP transaction code SM51 or check system information in SAP GUIVerify Fix Applied:
After patching, verify that authenticated users without proper authorization cannot delete restricted report variants.📡 Detection & Monitoring
Log Indicators:
- Unauthorized deletion of report variants in SAP audit logs
- Multiple report variant deletion attempts by single user
Network Indicators:
- Unusual patterns of report management transactions
SIEM Query:
source="sap_audit_log" AND (event="report_variant_delete" AND user NOT IN authorized_users_list)