CVE-2024-28167: SAP SE SAP Group Reporting Data Collection

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.

Affected products

• SAP SE SAP Group Reporting Data Collection: version s4core_104 only; version s4core_105 only; version s4core_106 only; version s4core_107 only; version s4core_108 only
• SAP SE SAP Group Reporting Data Collection Enter Package Data: version S4CORE 104 only; version S4CORE 105 only; version S4CORE 106 only; version S4CORE 107 only; version S4CORE 108 only

Published 2024-04-09. Last modified 2026-06-17.