CVE-2024-47576: DLL Hijacking vulnerability in SAP Product Lifecycle Costing
Description
SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Windows OS. This DLL is loaded from the computer running SAP Product Lifecycle Costing Client application. That particular DLL could be replaced by a malicious one, that could execute commands as being part of SAP Product Lifecycle Costing Client Application. On a successful attack, it can cause a low impact to confidentiality but no impact to the integrity and availability of the application.
Classification
CVE ID: CVE-2024-47576
CVSS Base Severity: LOW
CVSS Base Score: 3.3
Affected Products
Vendor: SAP_SE
Product: SAP Product Lifecycle Costing
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.44% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://me.sap.com/notes/3504847https://url.sap/sapsecuritypatchday