Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities found for SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server by SAP_SE

    CVE-2024-33005 (GCVE-0-2024-33005)

    Vulnerability from cvelistv5 – Published: 2024-08-13 03:47 – Updated: 2024-08-13 13:29
    VLAI
    Title
    Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server
    Summary
    Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP Content Server can impersonate other users and may perform some unintended actions. This could lead to a low impact on confidentiality and a high impact on the integrity and availability of the applications.
    Severity
    6.3 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    sap
    References
    Impacted products
    Vendor Product Version
    SAP_SE SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server Affected: KRNL64NUC 7.22
    Affected: KRNL64NUC 7.22EXT
    Affected: KRNL64UC 7.22
    Affected: KRNL64UC 7.22EXT
    Affected: KRNL64UC 7.53
    Affected: WEBDISP 7.53
    Affected: WEBDISP 7.77
    Affected: WEBDISP 7.85
    Affected: WEBDISP 7.22_EXT
    Affected: WEBDISP 7.89
    Affected: WEBDISP 7.54
    Affected: WEBDISP 7.93
    Affected: KERNEL 7.22
    Affected: KERNEL 7.53
    Affected: KERNEL 7.77
    Affected: KERNEL 7.85
    Affected: KERNEL 7.89
    Affected: KERNEL 7.54
    Affected: KERNEL 7.93
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-33005",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-13T13:28:54.486408Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-13T13:29:16.927Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22"
            },
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22EXT"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.22"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.22EXT"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.53"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.53"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.77"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.85"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.22_EXT"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.89"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.54"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.93"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.22"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.53"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.77"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.85"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.89"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.54"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.93"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Due to the missing authorization checks in the\nlocal systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application\nServer (ABAP and Java), and SAP Content Server can impersonate other users and\nmay perform some unintended actions. This could lead to a low impact on\nconfidentiality and a high impact on the integrity and availability of the\napplications."
            }
          ],
          "value": "Due to the missing authorization checks in the\nlocal systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application\nServer (ABAP and Java), and SAP Content Server can impersonate other users and\nmay perform some unintended actions. This could lead to a low impact on\nconfidentiality and a high impact on the integrity and availability of the\napplications."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-13T03:47:44.829Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3438085"
        },
        {
          "url": "https://url.sap/sapsecuritypatchday"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-33005",
    "datePublished": "2024-08-13T03:47:44.829Z",
    "dateReserved": "2024-04-23T04:04:25.521Z",
    "dateUpdated": "2024-08-13T13:29:16.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2024-33005 (GCVE-0-2024-33005)

    Vulnerability from nvd – Published: 2024-08-13 03:47 – Updated: 2024-08-13 13:29
    VLAI
    Title
    Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server
    Summary
    Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP Content Server can impersonate other users and may perform some unintended actions. This could lead to a low impact on confidentiality and a high impact on the integrity and availability of the applications.
    Severity
    6.3 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    sap
    References
    Impacted products
    Vendor Product Version
    SAP_SE SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server Affected: KRNL64NUC 7.22
    Affected: KRNL64NUC 7.22EXT
    Affected: KRNL64UC 7.22
    Affected: KRNL64UC 7.22EXT
    Affected: KRNL64UC 7.53
    Affected: WEBDISP 7.53
    Affected: WEBDISP 7.77
    Affected: WEBDISP 7.85
    Affected: WEBDISP 7.22_EXT
    Affected: WEBDISP 7.89
    Affected: WEBDISP 7.54
    Affected: WEBDISP 7.93
    Affected: KERNEL 7.22
    Affected: KERNEL 7.53
    Affected: KERNEL 7.77
    Affected: KERNEL 7.85
    Affected: KERNEL 7.89
    Affected: KERNEL 7.54
    Affected: KERNEL 7.93
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-33005",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-13T13:28:54.486408Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-13T13:29:16.927Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22"
            },
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22EXT"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.22"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.22EXT"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.53"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.53"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.77"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.85"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.22_EXT"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.89"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.54"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.93"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.22"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.53"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.77"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.85"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.89"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.54"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.93"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Due to the missing authorization checks in the\nlocal systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application\nServer (ABAP and Java), and SAP Content Server can impersonate other users and\nmay perform some unintended actions. This could lead to a low impact on\nconfidentiality and a high impact on the integrity and availability of the\napplications."
            }
          ],
          "value": "Due to the missing authorization checks in the\nlocal systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application\nServer (ABAP and Java), and SAP Content Server can impersonate other users and\nmay perform some unintended actions. This could lead to a low impact on\nconfidentiality and a high impact on the integrity and availability of the\napplications."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-13T03:47:44.829Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3438085"
        },
        {
          "url": "https://url.sap/sapsecuritypatchday"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-33005",
    "datePublished": "2024-08-13T03:47:44.829Z",
    "dateReserved": "2024-04-23T04:04:25.521Z",
    "dateUpdated": "2024-08-13T13:29:16.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}