Missing Authorization Check in SSC_E2E_STORE_BDCDATA

July 30, 2026

Missing Authorization Check in SSC_E2E_STORE_BDCDATA

Impact on Business

A remote, authenticated attacker can exploit a missing authorization check to insert arbitrary records into the INDX database table. This vulnerability has a low impact on the integrity of the system and its business applications.


Vulnerability Details

The remote-enabled function module SSC_E2E_STORE_BDCDATA within the SAP S4 Foundation component does not perform adequate authorization checks. This allows an authenticated attacker with basic RFC execution privileges to insert arbitrary data into the INDX table, potentially compromising the integrity of the affected system.


Solution

SAP has released SAP Note 3474590 which provides patched versions of the affected components.

The patches can be downloaded from https://me.sap.com/notes/3474590.

Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.


Report Timeline

  • 03/29/2024: Onapsis reports vulnerability to SAP
  • 08/13/2024: SAP issues the patch

References


Advisory Information

  • Public Release Date: 07/30/2026
  • Security Advisory ID: ONAPSIS-2026-0091
  • Researcher(s): Ignacio Favro

Vulnerability Information

  • Vendor: SAP
  • Affected Components: SAP S4 Foundation (S4FND) (Check SAP Note 3474590 for detailed information on affected releases)
  • Vulnerability Class: CWE-862: Missing Authorization
  • CVSS v3 score: 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
  • Risk Level: Medium
  • Assigned CVE: CVE-2024-42377
  • Vendor patch Information: SAP Security NOTE 3474590

Affected Components Description

  • SAP S4 Foundation (S4FND) Release 104

About our Research Labs

Onapsis Research Labs provides the industry analysis of key security issues that impact mission-critical systems and applications. Delivering frequent and timely security and compliance advisories with associated risk levels, Onapsis Research Labs combine in-depth knowledge and experience to deliver technical and business-context with sound security judgment to the broader information security community.

Find all reported vulnerabilities at: https://github.com/Onapsis/vulnerability_advisories

This advisory is licensed under a Creative Commons 4.0 BY-ND International License

Back To Advisories

Further Reading

Advisory

Open Redirection in SAP NetWeaver Application Server ABAP

Open Redirection in SAP NetWeaver Application Server ABAP Impact on Business An unauthenticated remote attacker can redirect users to arbitrary untrusted sites using a malicious link. Since the link initially points to a trusted server, phishing attempts are more likely to succeed, potentially leading to credential theft or other malicious actions against the victim. Vulnerability…

Read More
Advisory

SAP MDM Server – MDM Console Session Hijacking

SAP MDM Server – MDM Console Session Hijacking Impact on Business An unauthenticated remote attacker can hijack active sessions on the SAP MDM Console. This allows the attacker to access sensitive information, such as application logs and system details, and perform administrative actions, including the deletion of repositories. This vulnerability impacts the confidentiality, integrity, and…

Read More
Advisory

Reflected Cross-Site Scripting (XSS) in SAP NetWeaver

Reflected Cross-Site Scripting (XSS) in SAP NetWeaver Impact on Business Successful exploitation of this vulnerability allows an unauthenticated remote attacker to inject malicious JavaScript code into the application. This code is executed within the victim’s browser session when they interact with a crafted URL. This can lead to session hijacking, redirection to malicious websites, defacement…

Read More