CVE-2024-47576 — DLL Hijacking vulnerability in SAP Product Lifecycle Costing

Description (CNA)

SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Windows OS. This DLL is loaded from the computer running SAP Product Lifecycle Costing Client application. That particular DLL could be replaced by a malicious one, that could execute commands as being part of SAP Product Lifecycle Costing Client Application. On a successful attack, it can cause a low impact to confidentiality but no impact to the integrity and availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Product Lifecycle Costing	affected PLC_CLIENT 4

CWE

CWE-427

References

https://me.sap.com/notes/3504847
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.