Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2024-28166 (GCVE-0-2024-28166)
Vulnerability from cvelistv5 – Published: 2024-08-13 04:05 – Updated: 2024-12-10 06:22
VLAI?
EPSS
Summary
SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On successful
exploitation, the attacker can cause a low impact on the Integrity of the
application.
Severity ?
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SAP_SE | SAP BusinessObjects Business Intelligence Platform |
Affected:
ENTERPRISE 430
Affected: 2025 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28166",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-13T13:54:04.603269Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-13T13:54:21.863Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SAP BusinessObjects Business Intelligence Platform",
"vendor": "SAP_SE",
"versions": [
{
"status": "affected",
"version": "ENTERPRISE 430"
},
{
"status": "affected",
"version": "2025"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\n \u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003e\n \u003cp\u003eSAP BusinessObjects Business Intelligence\n Platform allows an authenticated attacker to upload malicious code over the\n network, that could be executed by the application. On successful\n exploitation, the attacker can cause a low impact on the Integrity of the\n application.\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "SAP BusinessObjects Business Intelligence\n Platform allows an authenticated attacker to upload malicious code over the\n network, that could be executed by the application. On successful\n exploitation, the attacker can cause a low impact on the Integrity of the\n application."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-10T06:22:53.694Z",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"url": "https://me.sap.com/notes/3433545"
},
{
"url": "https://me.sap.com/notes/3515653"
},
{
"url": "https://url.sap/sapsecuritypatchday"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2024-28166",
"datePublished": "2024-08-13T04:05:24.442Z",
"dateReserved": "2024-03-06T06:12:27.005Z",
"dateUpdated": "2024-12-10T06:22:53.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_objects_business_intelligence_platform:430:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6EB0EFA3-8AD2-42F2-86E1-A62ECF8340E3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_objects_business_intelligence_platform:440:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AD397634-7D49-454E-9854-0A8212008655\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:business_objects_business_intelligence_platform:enterprise_420:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"029BEDE8-97DB-4716-8A5D-D7CC8049B93F\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"SAP BusinessObjects Business Intelligence\\n Platform allows an authenticated attacker to upload malicious code over the\\n network, that could be executed by the application. On successful\\n exploitation, the attacker can cause a low impact on the Integrity of the\\n application.\"}, {\"lang\": \"es\", \"value\": \"La plataforma SAP BusinessObjects Business Intelligence permite a un atacante autenticado cargar c\\u00f3digo malicioso a trav\\u00e9s de la red, que podr\\u00eda ser ejecutado por la aplicaci\\u00f3n. Si la explotaci\\u00f3n tiene \\u00e9xito, el atacante puede causar un impacto bajo en la integridad de la aplicaci\\u00f3n.\"}]",
"id": "CVE-2024-28166",
"lastModified": "2024-12-10T07:15:04.890",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"cna@sap.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"baseScore\": 3.7, \"baseSeverity\": \"LOW\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 1.4}]}",
"published": "2024-08-13T04:15:06.867",
"references": "[{\"url\": \"https://me.sap.com/notes/3433545\", \"source\": \"cna@sap.com\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://me.sap.com/notes/3515653\", \"source\": \"cna@sap.com\"}, {\"url\": \"https://url.sap/sapsecuritypatchday\", \"source\": \"cna@sap.com\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "cna@sap.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"cna@sap.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-434\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-28166\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2024-08-13T04:15:06.867\",\"lastModified\":\"2024-12-10T07:15:04.890\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SAP BusinessObjects Business Intelligence\\n Platform allows an authenticated attacker to upload malicious code over the\\n network, that could be executed by the application. On successful\\n exploitation, the attacker can cause a low impact on the Integrity of the\\n application.\"},{\"lang\":\"es\",\"value\":\"La plataforma SAP BusinessObjects Business Intelligence permite a un atacante autenticado cargar c\u00f3digo malicioso a trav\u00e9s de la red, que podr\u00eda ser ejecutado por la aplicaci\u00f3n. Si la explotaci\u00f3n tiene \u00e9xito, el atacante puede causar un impacto bajo en la integridad de la aplicaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@sap.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":3.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"cna@sap.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-434\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_objects_business_intelligence_platform:430:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6EB0EFA3-8AD2-42F2-86E1-A62ECF8340E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_objects_business_intelligence_platform:440:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD397634-7D49-454E-9854-0A8212008655\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:business_objects_business_intelligence_platform:enterprise_420:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"029BEDE8-97DB-4716-8A5D-D7CC8049B93F\"}]}]}],\"references\":[{\"url\":\"https://me.sap.com/notes/3433545\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://me.sap.com/notes/3515653\",\"source\":\"cna@sap.com\"},{\"url\":\"https://url.sap/sapsecuritypatchday\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-28166\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-13T13:54:04.603269Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-13T13:54:14.965Z\"}}], \"cna\": {\"title\": \"Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SAP_SE\", \"product\": \"SAP BusinessObjects Business Intelligence Platform\", \"versions\": [{\"status\": \"affected\", \"version\": \"ENTERPRISE 430\"}, {\"status\": \"affected\", \"version\": \"2025\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://me.sap.com/notes/3433545\"}, {\"url\": \"https://me.sap.com/notes/3515653\"}, {\"url\": \"https://url.sap/sapsecuritypatchday\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"SAP BusinessObjects Business Intelligence\\n Platform allows an authenticated attacker to upload malicious code over the\\n network, that could be executed by the application. On successful\\n exploitation, the attacker can cause a low impact on the Integrity of the\\n application.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003ctable\u003e\\n \u003ctbody\u003e\u003ctr\u003e\\n \u003ctd\u003e\\n \u003cp\u003eSAP BusinessObjects Business Intelligence\\n Platform allows an authenticated attacker to upload malicious code over the\\n network, that could be executed by the application. On successful\\n exploitation, the attacker can cause a low impact on the Integrity of the\\n application.\u003c/p\u003e\\n \u003c/td\u003e\\n \u003c/tr\u003e\\n\u003c/tbody\u003e\u003c/table\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-434\", \"description\": \"CWE-434: Unrestricted Upload of File with Dangerous Type\"}]}], \"providerMetadata\": {\"orgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"shortName\": \"sap\", \"dateUpdated\": \"2024-12-10T06:22:53.694Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-28166\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-10T06:22:53.694Z\", \"dateReserved\": \"2024-03-06T06:12:27.005Z\", \"assignerOrgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"datePublished\": \"2024-08-13T04:05:24.442Z\", \"assignerShortName\": \"sap\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
CERTFR-2024-AVI-1054
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | NetWeaver Administrator (System Overview) version LM-CORE 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89 et 7.93 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.12 et 9.13 sans le dernier correctif de sécurité | ||
| SAP | N/A | HCM version S4HCMGXX 101 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS for JAVA (Adobe Document Services) version ADSSSAP 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Web Dispatcher versions WEBDISP 7.77, 7.89, 7.93, KERNEL 7.77, 7.89, 7.93, 9.12 et 9.13 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS JAVA version LM-CORE 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Product Lifecycle Costing version PLC_CLIENT 4 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver Administrator (System Overview) version LM-CORE 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89 et 7.93 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.12 et 9.13 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HCM version S4HCMGXX 101 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for JAVA (Adobe Document Services) version ADSSSAP 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Web Dispatcher versions WEBDISP 7.77, 7.89, 7.93, KERNEL 7.77, 7.89, 7.93, 9.12 et 9.13 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS JAVA version LM-CORE 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product Lifecycle Costing version PLC_CLIENT 4 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-54197",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54197"
},
{
"name": "CVE-2024-47586",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47586"
},
{
"name": "CVE-2024-47577",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47577"
},
{
"name": "CVE-2024-47578",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47578"
},
{
"name": "CVE-2024-47585",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47585"
},
{
"name": "CVE-2024-54198",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54198"
},
{
"name": "CVE-2024-28166",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28166"
},
{
"name": "CVE-2024-41731",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41731"
},
{
"name": "CVE-2024-47581",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47581"
},
{
"name": "CVE-2024-47590",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47590"
},
{
"name": "CVE-2024-32732",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32732"
},
{
"name": "CVE-2024-47576",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47576"
},
{
"name": "CVE-2024-42375",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42375"
},
{
"name": "CVE-2024-47579",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47579"
},
{
"name": "CVE-2024-47580",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47580"
},
{
"name": "CVE-2024-47582",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47582"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-1054",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-12-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-12-10",
"title": "Bulletin de s\u00e9curit\u00e9 SAP december-2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2024.html"
}
]
}
CERTFR-2024-AVI-1054
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | NetWeaver Administrator (System Overview) version LM-CORE 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89 et 7.93 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.12 et 9.13 sans le dernier correctif de sécurité | ||
| SAP | N/A | HCM version S4HCMGXX 101 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS for JAVA (Adobe Document Services) version ADSSSAP 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Web Dispatcher versions WEBDISP 7.77, 7.89, 7.93, KERNEL 7.77, 7.89, 7.93, 9.12 et 9.13 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 2025 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS JAVA version LM-CORE 7.50 sans le dernier correctif de sécurité | ||
| SAP | N/A | Product Lifecycle Costing version PLC_CLIENT 4 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver Administrator (System Overview) version LM-CORE 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89 et 7.93 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.12 et 9.13 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "HCM version S4HCMGXX 101 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS for JAVA (Adobe Document Services) version ADSSSAP 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Web Dispatcher versions WEBDISP 7.77, 7.89, 7.93, KERNEL 7.77, 7.89, 7.93, 9.12 et 9.13 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 2025 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS JAVA version LM-CORE 7.50 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Product Lifecycle Costing version PLC_CLIENT 4 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-54197",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54197"
},
{
"name": "CVE-2024-47586",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47586"
},
{
"name": "CVE-2024-47577",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47577"
},
{
"name": "CVE-2024-47578",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47578"
},
{
"name": "CVE-2024-47585",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47585"
},
{
"name": "CVE-2024-54198",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54198"
},
{
"name": "CVE-2024-28166",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28166"
},
{
"name": "CVE-2024-41731",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41731"
},
{
"name": "CVE-2024-47581",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47581"
},
{
"name": "CVE-2024-47590",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47590"
},
{
"name": "CVE-2024-32732",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32732"
},
{
"name": "CVE-2024-47576",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47576"
},
{
"name": "CVE-2024-42375",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42375"
},
{
"name": "CVE-2024-47579",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47579"
},
{
"name": "CVE-2024-47580",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47580"
},
{
"name": "CVE-2024-47582",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47582"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-1054",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-12-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-12-10",
"title": "Bulletin de s\u00e9curit\u00e9 SAP december-2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2024.html"
}
]
}
CERTFR-2024-AVI-0671
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | NetWeaver Application Server (ABAP and Java), Web Dispatcher and Content Server versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.53, 7.77, 7.85, 7.22_EXT, 7.89, 7.54, 7.93, KERNEL 7.22, 7.53, 7.77, 7.85, 7.89, 7.54 et 7.93 sans le dernier correctif de sécurité | ||
| SAP | N/A | Build Apps version 4.11.130 sans le dernier correctif de sécurité | ||
| SAP | N/A | Permit to Work versions UIS4HOP1 800 et 900 sans le dernier correctif de sécurité | ||
| SAP | N/A | CRM ABAP (Insights Management) versions BBPCRM 700, 701, 702, 712, 713 et 714 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP versions SAP_UI 754, 755, 756, 757, 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731 et SAP_BASIS 912 sans le dernier correctif de sécurité | ||
| SAP | N/A | Student Life Cycle Management (SLcM) versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 912 sans le dernier correctif de sécurité | ||
| SAP | N/A | BEx Web Java Runtime Export Web Service versions BI-BASE-E 7.5, BI-BASE-B 7.5, BI-IBC 7.5, BI-BASE-S 7.5 et BIWEBAPP 7.5 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Cloud versions HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | Replication Server versions 16.0.3 et 16.0.4 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 440 sans le dernier correctif de sécurité | ||
| SAP | N/A | Document Builder versions S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de sécurité | ||
| SAP | N/A | Landscape Management version VCM 3.00 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Workflow (WebFlow Services) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Shared Service Framework versions SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Warehouse - Business Planning and Simulation versions SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS Java version MMR_SERVER 7.5 sans le dernier correctif de sécurité | ||
| SAP | N/A | Bank Account Management (Manage Banks) versions 800 et 900 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Backoffice version HY_COM 2205 sans le dernier correctif de sécurité | ||
| SAP | N/A | BW/4HANA Transformation and Data Transfer Process versions DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de sécurité | ||
| SAP | N/A | Document Builder versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, SAP_BS_FND 702, SAP_BS_FND 731, SAP_BS_FND 746, SAP_BS_FND 747 et SAP_BS_FND 748 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver Application Server (ABAP and Java), Web Dispatcher and Content Server versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.53, 7.77, 7.85, 7.22_EXT, 7.89, 7.54, 7.93, KERNEL 7.22, 7.53, 7.77, 7.85, 7.89, 7.54 et 7.93 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Build Apps version 4.11.130 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Permit to Work versions UIS4HOP1 800 et 900 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM ABAP (Insights Management) versions BBPCRM 700, 701, 702, 712, 713 et 714 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions SAP_UI 754, 755, 756, 757, 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731 et SAP_BASIS 912 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Student Life Cycle Management (SLcM) versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 912 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BEx Web Java Runtime Export Web Service versions BI-BASE-E 7.5, BI-BASE-B 7.5, BI-IBC 7.5, BI-BASE-S 7.5 et BIWEBAPP 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Replication Server versions 16.0.3 et 16.0.4\u00a0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Document Builder versions S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Landscape Management version VCM 3.00 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Workflow (WebFlow Services) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Shared Service Framework versions SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse - Business Planning and Simulation versions SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java version MMR_SERVER 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Bank Account Management (Manage Banks) versions 800 et 900 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Backoffice version HY_COM 2205 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BW/4HANA Transformation and Data Transfer Process versions DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Document Builder versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, SAP_BS_FND 702, SAP_BS_FND 731, SAP_BS_FND 746, SAP_BS_FND 747 et SAP_BS_FND 748 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-37176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37176"
},
{
"name": "CVE-2024-41732",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41732"
},
{
"name": "CVE-2024-34689",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34689"
},
{
"name": "CVE-2024-33003",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33003"
},
{
"name": "CVE-2023-0215",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
},
{
"name": "CVE-2024-41733",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41733"
},
{
"name": "CVE-2023-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
},
{
"name": "CVE-2024-29415",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29415"
},
{
"name": "CVE-2024-41734",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41734"
},
{
"name": "CVE-2024-42373",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42373"
},
{
"name": "CVE-2024-41737",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41737"
},
{
"name": "CVE-2024-34683",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34683"
},
{
"name": "CVE-2024-37180",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37180"
},
{
"name": "CVE-2024-34688",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34688"
},
{
"name": "CVE-2024-33005",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33005"
},
{
"name": "CVE-2024-28166",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28166"
},
{
"name": "CVE-2024-41731",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41731"
},
{
"name": "CVE-2024-39594",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39594"
},
{
"name": "CVE-2023-30533",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30533"
},
{
"name": "CVE-2024-42376",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42376"
},
{
"name": "CVE-2024-39591",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39591"
},
{
"name": "CVE-2024-41736",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41736"
},
{
"name": "CVE-2022-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
},
{
"name": "CVE-2023-0023",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0023"
},
{
"name": "CVE-2024-42375",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42375"
},
{
"name": "CVE-2024-39593",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39593"
},
{
"name": "CVE-2024-41730",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41730"
},
{
"name": "CVE-2024-41735",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41735"
},
{
"name": "CVE-2024-42374",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42374"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0671",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-08-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-08-13",
"title": "Bulletin de s\u00e9curit\u00e9 SAP august-2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2024.html"
}
]
}
CERTFR-2024-AVI-0671
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SAP | N/A | NetWeaver Application Server (ABAP and Java), Web Dispatcher and Content Server versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.53, 7.77, 7.85, 7.22_EXT, 7.89, 7.54, 7.93, KERNEL 7.22, 7.53, 7.77, 7.85, 7.89, 7.54 et 7.93 sans le dernier correctif de sécurité | ||
| SAP | N/A | Build Apps version 4.11.130 sans le dernier correctif de sécurité | ||
| SAP | N/A | Permit to Work versions UIS4HOP1 800 et 900 sans le dernier correctif de sécurité | ||
| SAP | N/A | CRM ABAP (Insights Management) versions BBPCRM 700, 701, 702, 712, 713 et 714 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP versions SAP_UI 754, 755, 756, 757, 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731 et SAP_BASIS 912 sans le dernier correctif de sécurité | ||
| SAP | N/A | Student Life Cycle Management (SLcM) versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 912 sans le dernier correctif de sécurité | ||
| SAP | N/A | BEx Web Java Runtime Export Web Service versions BI-BASE-E 7.5, BI-BASE-B 7.5, BI-IBC 7.5, BI-BASE-S 7.5 et BIWEBAPP 7.5 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Cloud versions HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | Replication Server versions 16.0.3 et 16.0.4 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 440 sans le dernier correctif de sécurité | ||
| SAP | N/A | Document Builder versions S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de sécurité | ||
| SAP | N/A | Landscape Management version VCM 3.00 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Workflow (WebFlow Services) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Shared Service Framework versions SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de sécurité | ||
| SAP | N/A | Business Warehouse - Business Planning and Simulation versions SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver AS Java version MMR_SERVER 7.5 sans le dernier correctif de sécurité | ||
| SAP | N/A | Bank Account Management (Manage Banks) versions 800 et 900 sans le dernier correctif de sécurité | ||
| SAP | N/A | NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | Commerce Backoffice version HY_COM 2205 sans le dernier correctif de sécurité | ||
| SAP | N/A | BW/4HANA Transformation and Data Transfer Process versions DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité | ||
| SAP | N/A | BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de sécurité | ||
| SAP | N/A | Document Builder versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, SAP_BS_FND 702, SAP_BS_FND 731, SAP_BS_FND 746, SAP_BS_FND 747 et SAP_BS_FND 748 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetWeaver Application Server (ABAP and Java), Web Dispatcher and Content Server versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, WEBDISP 7.53, 7.77, 7.85, 7.22_EXT, 7.89, 7.54, 7.93, KERNEL 7.22, 7.53, 7.77, 7.85, 7.89, 7.54 et 7.93 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Build Apps version 4.11.130 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Permit to Work versions UIS4HOP1 800 et 900 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "CRM ABAP (Insights Management) versions BBPCRM 700, 701, 702, 712, 713 et 714 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP versions SAP_UI 754, 755, 756, 757, 758, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731 et SAP_BASIS 912 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Student Life Cycle Management (SLcM) versions IS-PS-CA 617, 618, 802, 803, 804, 805, 806, 807 et 808 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 912 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BEx Web Java Runtime Export Web Service versions BI-BASE-E 7.5, BI-BASE-B 7.5, BI-IBC 7.5, BI-BASE-S 7.5 et BIWEBAPP 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Cloud versions HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Replication Server versions 16.0.3 et 16.0.4\u00a0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Document Builder versions S4CORE 100, 101, S4FND 102, 103, 104, 105, 106, 107, 108, SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Landscape Management version VCM 3.00 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Workflow (WebFlow Services) versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Shared Service Framework versions SAP_BS_FND 702, 731, 746, 747 et 748 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Business Warehouse - Business Planning and Simulation versions SAP_BW 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758 et SAP_BW_VIRTUAL_COMP 701 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver AS Java version MMR_SERVER 7.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Bank Account Management (Manage Banks) versions 800 et 900 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 et SAP_BASIS 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Commerce Backoffice version HY_COM 2205 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BW/4HANA Transformation and Data Transfer Process versions DW4CORE 200, 300, 400, 796, SAP_BW 740, 750, 751, 752, 753, 754, 755, 756, 757 et 758 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "BusinessObjects Business Intelligence Platform versions ENTERPRISE 420, 430 et 440 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
},
{
"description": "Document Builder versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, SAP_BS_FND 702, SAP_BS_FND 731, SAP_BS_FND 746, SAP_BS_FND 747 et SAP_BS_FND 748 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "SAP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-37176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37176"
},
{
"name": "CVE-2024-41732",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41732"
},
{
"name": "CVE-2024-34689",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34689"
},
{
"name": "CVE-2024-33003",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33003"
},
{
"name": "CVE-2023-0215",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0215"
},
{
"name": "CVE-2024-41733",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41733"
},
{
"name": "CVE-2023-0286",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
},
{
"name": "CVE-2024-29415",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29415"
},
{
"name": "CVE-2024-41734",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41734"
},
{
"name": "CVE-2024-42373",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42373"
},
{
"name": "CVE-2024-41737",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41737"
},
{
"name": "CVE-2024-34683",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34683"
},
{
"name": "CVE-2024-37180",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37180"
},
{
"name": "CVE-2024-34688",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34688"
},
{
"name": "CVE-2024-33005",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33005"
},
{
"name": "CVE-2024-28166",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28166"
},
{
"name": "CVE-2024-41731",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41731"
},
{
"name": "CVE-2024-39594",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39594"
},
{
"name": "CVE-2023-30533",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30533"
},
{
"name": "CVE-2024-42376",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42376"
},
{
"name": "CVE-2024-39591",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39591"
},
{
"name": "CVE-2024-41736",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41736"
},
{
"name": "CVE-2022-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
},
{
"name": "CVE-2023-0023",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0023"
},
{
"name": "CVE-2024-42375",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42375"
},
{
"name": "CVE-2024-39593",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39593"
},
{
"name": "CVE-2024-41730",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41730"
},
{
"name": "CVE-2024-41735",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41735"
},
{
"name": "CVE-2024-42374",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42374"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0671",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-08-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP",
"vendor_advisories": [
{
"published_at": "2024-08-13",
"title": "Bulletin de s\u00e9curit\u00e9 SAP august-2024",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2024.html"
}
]
}
FKIE_CVE-2024-28166
Vulnerability from fkie_nvd - Published: 2024-08-13 04:15 - Updated: 2024-12-10 07:15
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On successful
exploitation, the attacker can cause a low impact on the Integrity of the
application.
References
| URL | Tags | ||
|---|---|---|---|
| cna@sap.com | https://me.sap.com/notes/3433545 | Permissions Required | |
| cna@sap.com | https://me.sap.com/notes/3515653 | ||
| cna@sap.com | https://url.sap/sapsecuritypatchday | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| sap | business_objects_business_intelligence_platform | 430 | |
| sap | business_objects_business_intelligence_platform | 440 | |
| sap | business_objects_business_intelligence_platform | enterprise_420 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:430:*:*:*:*:*:*:*",
"matchCriteriaId": "6EB0EFA3-8AD2-42F2-86E1-A62ECF8340E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:440:*:*:*:*:*:*:*",
"matchCriteriaId": "AD397634-7D49-454E-9854-0A8212008655",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:business_objects_business_intelligence_platform:enterprise_420:*:*:*:*:*:*:*",
"matchCriteriaId": "029BEDE8-97DB-4716-8A5D-D7CC8049B93F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SAP BusinessObjects Business Intelligence\n Platform allows an authenticated attacker to upload malicious code over the\n network, that could be executed by the application. On successful\n exploitation, the attacker can cause a low impact on the Integrity of the\n application."
},
{
"lang": "es",
"value": "La plataforma SAP BusinessObjects Business Intelligence permite a un atacante autenticado cargar c\u00f3digo malicioso a trav\u00e9s de la red, que podr\u00eda ser ejecutado por la aplicaci\u00f3n. Si la explotaci\u00f3n tiene \u00e9xito, el atacante puede causar un impacto bajo en la integridad de la aplicaci\u00f3n."
}
],
"id": "CVE-2024-28166",
"lastModified": "2024-12-10T07:15:04.890",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 1.4,
"source": "cna@sap.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-08-13T04:15:06.867",
"references": [
{
"source": "cna@sap.com",
"tags": [
"Permissions Required"
],
"url": "https://me.sap.com/notes/3433545"
},
{
"source": "cna@sap.com",
"url": "https://me.sap.com/notes/3515653"
},
{
"source": "cna@sap.com",
"tags": [
"Vendor Advisory"
],
"url": "https://url.sap/sapsecuritypatchday"
}
],
"sourceIdentifier": "cna@sap.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "cna@sap.com",
"type": "Primary"
}
]
}
GSD-2024-28166
Vulnerability from gsd - Updated: 2024-03-07 06:02Details
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
Aliases
{
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2024-28166"
],
"id": "GSD-2024-28166",
"modified": "2024-03-07T06:02:29.552259Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2024-28166",
"STATE": "RESERVED"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}
}
}
NCSC-2024-0333
Vulnerability from csaf_ncscnl - Published: 2024-08-13 13:47 - Updated: 2024-08-13 13:47Summary
Kwetsbaarheden verholpen in SAP producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
SAP heeft kwetsbaarheden verholpen in diverse producten als SAP Business Objects, SAP HANA, Netweaver en Document Builder.
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Server Side Request Forgery (SSRF)
- Cross-Site Scripting (XSS)
- Omzeilen van authenticatie
- Omzeilen van beveiligingsmaatregel
- Manipulatie van gegevens
- Toegang tot gevoelige gegevens
Oplossingen
SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen in de kwetsbare producten. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-20
Improper Input Validation
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-284
Improper Access Control
CWE-416
Use After Free
CWE-434
Unrestricted Upload of File with Dangerous Type
CWE-704
Incorrect Type Conversion or Cast
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-862
Missing Authorization
CWE-91
XML Injection (aka Blind XPath Injection)
CWE-918
Server-Side Request Forgery (SSRF)
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "SAP heeft kwetsbaarheden verholpen in diverse producten als SAP Business Objects, SAP HANA, Netweaver en Document Builder.",
"title": "Feiten"
},
{
"category": "description",
"text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Server Side Request Forgery (SSRF)\n- Cross-Site Scripting (XSS)\n- Omzeilen van authenticatie\n- Omzeilen van beveiligingsmaatregel\n- Manipulatie van gegevens\n- Toegang tot gevoelige gegevens",
"title": "Interpretaties"
},
{
"category": "description",
"text": "SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen in de kwetsbare producten. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "general",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "Improper Access Control",
"title": "CWE-284"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "Unrestricted Upload of File with Dangerous Type",
"title": "CWE-434"
},
{
"category": "general",
"text": "Incorrect Type Conversion or Cast",
"title": "CWE-704"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "general",
"text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"title": "CWE-835"
},
{
"category": "general",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "general",
"text": "XML Injection (aka Blind XPath Injection)",
"title": "CWE-91"
},
{
"category": "general",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference - certbundde",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2024.html"
}
],
"title": "Kwetsbaarheden verholpen in SAP producten",
"tracking": {
"current_release_date": "2024-08-13T13:47:02.764070Z",
"id": "NCSC-2024-0333",
"initial_release_date": "2024-08-13T13:47:02.764070Z",
"revision_history": [
{
"date": "2024-08-13T13:47:02.764070Z",
"number": "0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "sap_bex_web_java_runtime_export_web_service",
"product": {
"name": "sap_bex_web_java_runtime_export_web_service",
"product_id": "CSAFPID-1614277",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_bex_web_java_runtime_export_web_service:bi-base-b_7.5:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_bex_web_java_runtime_export_web_service",
"product": {
"name": "sap_bex_web_java_runtime_export_web_service",
"product_id": "CSAFPID-1614276",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_bex_web_java_runtime_export_web_service:bi-base-e_7.5:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_bex_web_java_runtime_export_web_service",
"product": {
"name": "sap_bex_web_java_runtime_export_web_service",
"product_id": "CSAFPID-1614279",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_bex_web_java_runtime_export_web_service:bi-base-s_7.5:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_bex_web_java_runtime_export_web_service",
"product": {
"name": "sap_bex_web_java_runtime_export_web_service",
"product_id": "CSAFPID-1614278",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_bex_web_java_runtime_export_web_service:bi-ibc_7.5:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_bex_web_java_runtime_export_web_service",
"product": {
"name": "sap_bex_web_java_runtime_export_web_service",
"product_id": "CSAFPID-1614280",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_bex_web_java_runtime_export_web_service:biwebapp_7.5:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_businessobjects_business_intelligence_platform",
"product": {
"name": "sap_businessobjects_business_intelligence_platform",
"product_id": "CSAFPID-1464457",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_businessobjects_business_intelligence_platform:430:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_businessobjects_business_intelligence_platform",
"product": {
"name": "sap_businessobjects_business_intelligence_platform",
"product_id": "CSAFPID-1464458",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_businessobjects_business_intelligence_platform:440:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_businessobjects_business_intelligence_platform",
"product": {
"name": "sap_businessobjects_business_intelligence_platform",
"product_id": "CSAFPID-1475737",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_businessobjects_business_intelligence_platform:enterprise_420:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_businessobjects_business_intelligence_platform",
"product": {
"name": "sap_businessobjects_business_intelligence_platform",
"product_id": "CSAFPID-1614275",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_businessobjects_business_intelligence_platform:enterprise_430:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_commerce_backoffice",
"product": {
"name": "sap_commerce_backoffice",
"product_id": "CSAFPID-1614262",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_commerce_backoffice:hy_com_2205:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_commerce_cloud",
"product": {
"name": "sap_commerce_cloud",
"product_id": "CSAFPID-1614269",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_commerce_cloud:1811:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_commerce_cloud",
"product": {
"name": "sap_commerce_cloud",
"product_id": "CSAFPID-1614270",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_commerce_cloud:1905:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_commerce_cloud",
"product": {
"name": "sap_commerce_cloud",
"product_id": "CSAFPID-1614271",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_commerce_cloud:2005:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_commerce_cloud",
"product": {
"name": "sap_commerce_cloud",
"product_id": "CSAFPID-1614273",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_commerce_cloud:2011:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_commerce_cloud",
"product": {
"name": "sap_commerce_cloud",
"product_id": "CSAFPID-1614272",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_commerce_cloud:2105:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_commerce_cloud",
"product": {
"name": "sap_commerce_cloud",
"product_id": "CSAFPID-1614274",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_commerce_cloud:2205:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_commerce_cloud",
"product": {
"name": "sap_commerce_cloud",
"product_id": "CSAFPID-1548429",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_commerce_cloud:com_cloud_2211:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_commerce_cloud",
"product": {
"name": "sap_commerce_cloud",
"product_id": "CSAFPID-1614268",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_commerce_cloud:hy_com_1808:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_commerce",
"product": {
"name": "sap_commerce",
"product_id": "CSAFPID-1495976",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_commerce:com_cloud_2211:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_commerce",
"product": {
"name": "sap_commerce",
"product_id": "CSAFPID-1495975",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_commerce:hy_com_2205:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_crm_abap__insights_management_",
"product": {
"name": "sap_crm_abap__insights_management_",
"product_id": "CSAFPID-1614238",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_crm_abap__insights_management_:701:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_crm_abap__insights_management_",
"product": {
"name": "sap_crm_abap__insights_management_",
"product_id": "CSAFPID-1614239",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_crm_abap__insights_management_:702:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_crm_abap__insights_management_",
"product": {
"name": "sap_crm_abap__insights_management_",
"product_id": "CSAFPID-1614240",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_crm_abap__insights_management_:712:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_crm_abap__insights_management_",
"product": {
"name": "sap_crm_abap__insights_management_",
"product_id": "CSAFPID-1614241",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_crm_abap__insights_management_:713:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_crm_abap__insights_management_",
"product": {
"name": "sap_crm_abap__insights_management_",
"product_id": "CSAFPID-1614242",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_crm_abap__insights_management_:714:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_crm_abap__insights_management_",
"product": {
"name": "sap_crm_abap__insights_management_",
"product_id": "CSAFPID-1614237",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_crm_abap__insights_management_:bbpcrm_700:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_document_builder",
"product": {
"name": "sap_document_builder",
"product_id": "CSAFPID-1475725",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_document_builder:s4fnd_102:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_document_builder",
"product": {
"name": "sap_document_builder",
"product_id": "CSAFPID-1614203",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_document_builder:s4fnd_103:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_document_builder",
"product": {
"name": "sap_document_builder",
"product_id": "CSAFPID-1614204",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_document_builder:s4fnd_104:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_document_builder",
"product": {
"name": "sap_document_builder",
"product_id": "CSAFPID-1614205",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_document_builder:s4fnd_105:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_document_builder",
"product": {
"name": "sap_document_builder",
"product_id": "CSAFPID-1614206",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_document_builder:s4fnd_106:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_document_builder",
"product": {
"name": "sap_document_builder",
"product_id": "CSAFPID-1614207",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_document_builder:s4fnd_107:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_document_builder",
"product": {
"name": "sap_document_builder",
"product_id": "CSAFPID-1614208",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_document_builder:s4fnd_108:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_document_builder",
"product": {
"name": "sap_document_builder",
"product_id": "CSAFPID-1475732",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_document_builder:sap_bs_fnd_702:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_document_builder",
"product": {
"name": "sap_document_builder",
"product_id": "CSAFPID-1614209",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_document_builder:sap_bs_fnd_731:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_document_builder",
"product": {
"name": "sap_document_builder",
"product_id": "CSAFPID-1614210",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_document_builder:sap_bs_fnd_746:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_document_builder",
"product": {
"name": "sap_document_builder",
"product_id": "CSAFPID-1614211",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_document_builder:sap_bs_fnd_747:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_document_builder",
"product": {
"name": "sap_document_builder",
"product_id": "CSAFPID-1614212",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_document_builder:sap_bs_fnd_748:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614255",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:kernel_7.22:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614256",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:kernel_7.53:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614260",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:kernel_7.54:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614257",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:kernel_7.77:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614258",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:kernel_7.85:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614259",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:kernel_7.89:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614261",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:kernel_7.93:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614243",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:krnl64nuc_7.22:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614244",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:krnl64nuc_7.22ext:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614245",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:krnl64uc_7.22:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614246",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:krnl64uc_7.22ext:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614247",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:krnl64uc_7.53:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614251",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:webdisp_7.22_ext:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614248",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:webdisp_7.53:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614253",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:webdisp_7.54:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614249",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:webdisp_7.77:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614250",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:webdisp_7.85:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614252",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:webdisp_7.89:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product": {
"name": "sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server",
"product_id": "CSAFPID-1614254",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server__abap_and_java__sap_web_dispatcher_and_sap_content_server:webdisp_7.93:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1465636",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_700:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1614223",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_701:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1614224",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_702:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1465639",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_731:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1465640",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_740:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1465641",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_750:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1465642",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_751:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1465643",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_752:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1465644",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_753:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1465645",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_754:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1465646",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_755:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1465647",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_756:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1465648",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_757:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1614225",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_758:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product": {
"name": "sap_netweaver_application_server_abap_and_abap_platform",
"product_id": "CSAFPID-1614226",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:sap_basis_912:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap",
"product": {
"name": "sap_netweaver_application_server_abap",
"product_id": "CSAFPID-1559117",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap:755:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap",
"product": {
"name": "sap_netweaver_application_server_abap",
"product_id": "CSAFPID-1559118",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap:756:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap",
"product": {
"name": "sap_netweaver_application_server_abap",
"product_id": "CSAFPID-1614230",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap:757:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap",
"product": {
"name": "sap_netweaver_application_server_abap",
"product_id": "CSAFPID-1614231",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap:758:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap",
"product": {
"name": "sap_netweaver_application_server_abap",
"product_id": "CSAFPID-1614232",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap:sap_basis_700:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap",
"product": {
"name": "sap_netweaver_application_server_abap",
"product_id": "CSAFPID-1614233",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap:sap_basis_701:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap",
"product": {
"name": "sap_netweaver_application_server_abap",
"product_id": "CSAFPID-1614234",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap:sap_basis_702:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap",
"product": {
"name": "sap_netweaver_application_server_abap",
"product_id": "CSAFPID-1614235",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap:sap_basis_731:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap",
"product": {
"name": "sap_netweaver_application_server_abap",
"product_id": "CSAFPID-1614236",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap:sap_basis_912:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_netweaver_application_server_abap",
"product": {
"name": "sap_netweaver_application_server_abap",
"product_id": "CSAFPID-1614229",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_netweaver_application_server_abap:sap_ui_754:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_permit_to_work",
"product": {
"name": "sap_permit_to_work",
"product_id": "CSAFPID-1614228",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_permit_to_work:900:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_permit_to_work",
"product": {
"name": "sap_permit_to_work",
"product_id": "CSAFPID-1614227",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_permit_to_work:uis4hop1_800:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_shared_service_framework",
"product": {
"name": "sap_shared_service_framework",
"product_id": "CSAFPID-1614264",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_shared_service_framework:731:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_shared_service_framework",
"product": {
"name": "sap_shared_service_framework",
"product_id": "CSAFPID-1614265",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_shared_service_framework:746:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_shared_service_framework",
"product": {
"name": "sap_shared_service_framework",
"product_id": "CSAFPID-1614266",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_shared_service_framework:747:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_shared_service_framework",
"product": {
"name": "sap_shared_service_framework",
"product_id": "CSAFPID-1614267",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_shared_service_framework:748:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_shared_service_framework",
"product": {
"name": "sap_shared_service_framework",
"product_id": "CSAFPID-1614263",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_shared_service_framework:sap_bs_fnd_702:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_student_life_cycle_management__slcm_",
"product": {
"name": "sap_student_life_cycle_management__slcm_",
"product_id": "CSAFPID-1614213",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management__slcm_:617:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_student_life_cycle_management__slcm_",
"product": {
"name": "sap_student_life_cycle_management__slcm_",
"product_id": "CSAFPID-1614214",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management__slcm_:618:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_student_life_cycle_management__slcm_",
"product": {
"name": "sap_student_life_cycle_management__slcm_",
"product_id": "CSAFPID-1614215",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management__slcm_:802:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_student_life_cycle_management__slcm_",
"product": {
"name": "sap_student_life_cycle_management__slcm_",
"product_id": "CSAFPID-1614216",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management__slcm_:803:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_student_life_cycle_management__slcm_",
"product": {
"name": "sap_student_life_cycle_management__slcm_",
"product_id": "CSAFPID-1614217",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management__slcm_:804:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_student_life_cycle_management__slcm_",
"product": {
"name": "sap_student_life_cycle_management__slcm_",
"product_id": "CSAFPID-1614218",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management__slcm_:805:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_student_life_cycle_management__slcm_",
"product": {
"name": "sap_student_life_cycle_management__slcm_",
"product_id": "CSAFPID-1614219",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management__slcm_:806:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_student_life_cycle_management__slcm_",
"product": {
"name": "sap_student_life_cycle_management__slcm_",
"product_id": "CSAFPID-1614220",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management__slcm_:807:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap_student_life_cycle_management__slcm_",
"product": {
"name": "sap_student_life_cycle_management__slcm_",
"product_id": "CSAFPID-1614221",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management__slcm_:808:*:*:*:*:*:*:*"
}
}
}
],
"category": "vendor",
"name": "sap_se"
},
{
"branches": [
{
"category": "product_name",
"name": "businessobjects_business_intelligence_platform",
"product": {
"name": "businessobjects_business_intelligence_platform",
"product_id": "CSAFPID-55201",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:420:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "businessobjects_business_intelligence_platform",
"product": {
"name": "businessobjects_business_intelligence_platform",
"product_id": "CSAFPID-55202",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:430:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "businessobjects_business_intelligence_platform",
"product": {
"name": "businessobjects_business_intelligence_platform",
"product_id": "CSAFPID-955724",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:businessobjects_business_intelligence_platform:440:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "commerce_backoffice",
"product": {
"name": "commerce_backoffice",
"product_id": "CSAFPID-1614815",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:commerce_backoffice:2205:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "document_builder",
"product": {
"name": "document_builder",
"product_id": "CSAFPID-1611687",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:document_builder:s4fnd_102:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "document_builder",
"product": {
"name": "document_builder",
"product_id": "CSAFPID-1614517",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:document_builder:s4fnd_103:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "document_builder",
"product": {
"name": "document_builder",
"product_id": "CSAFPID-1614513",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:document_builder:s4fnd_104:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "document_builder",
"product": {
"name": "document_builder",
"product_id": "CSAFPID-1614515",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:document_builder:s4fnd_105:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "document_builder",
"product": {
"name": "document_builder",
"product_id": "CSAFPID-1614521",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:document_builder:s4fnd_106:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "document_builder",
"product": {
"name": "document_builder",
"product_id": "CSAFPID-1614522",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:document_builder:s4fnd_107:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "document_builder",
"product": {
"name": "document_builder",
"product_id": "CSAFPID-1614520",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:document_builder:s4fnd_108:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "document_builder",
"product": {
"name": "document_builder",
"product_id": "CSAFPID-1611685",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:document_builder:sap_bs_fnd_702:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "document_builder",
"product": {
"name": "document_builder",
"product_id": "CSAFPID-1614518",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:document_builder:sap_bs_fnd_731:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "document_builder",
"product": {
"name": "document_builder",
"product_id": "CSAFPID-1614519",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:document_builder:sap_bs_fnd_746:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "document_builder",
"product": {
"name": "document_builder",
"product_id": "CSAFPID-1614516",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:document_builder:sap_bs_fnd_747:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "document_builder",
"product": {
"name": "document_builder",
"product_id": "CSAFPID-1614514",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:document_builder:sap_bs_fnd_748:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "sap",
"product": {
"name": "sap",
"product_id": "CSAFPID-1498297",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:sap:-:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "student_life_cycle_management",
"product": {
"name": "student_life_cycle_management",
"product_id": "CSAFPID-1614510",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:student_life_cycle_management:617:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "student_life_cycle_management",
"product": {
"name": "student_life_cycle_management",
"product_id": "CSAFPID-1475930",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:student_life_cycle_management:618:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "student_life_cycle_management",
"product": {
"name": "student_life_cycle_management",
"product_id": "CSAFPID-1475932",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:student_life_cycle_management:802:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "student_life_cycle_management",
"product": {
"name": "student_life_cycle_management",
"product_id": "CSAFPID-1475933",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:student_life_cycle_management:803:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "student_life_cycle_management",
"product": {
"name": "student_life_cycle_management",
"product_id": "CSAFPID-1475927",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:student_life_cycle_management:804:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "student_life_cycle_management",
"product": {
"name": "student_life_cycle_management",
"product_id": "CSAFPID-1475931",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:student_life_cycle_management:805:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "student_life_cycle_management",
"product": {
"name": "student_life_cycle_management",
"product_id": "CSAFPID-1475928",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:student_life_cycle_management:806:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "student_life_cycle_management",
"product": {
"name": "student_life_cycle_management",
"product_id": "CSAFPID-1475934",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:student_life_cycle_management:807:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "student_life_cycle_management",
"product": {
"name": "student_life_cycle_management",
"product_id": "CSAFPID-1475929",
"product_identification_helper": {
"cpe": "cpe:2.3:a:sap:student_life_cycle_management:808:*:*:*:*:*:*:*"
}
}
}
],
"category": "vendor",
"name": "sap"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-0778",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "other",
"text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"title": "CWE-835"
}
],
"references": [
{
"category": "self",
"summary": "CVE-2022-0778",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-0778.json"
}
],
"title": "CVE-2022-0778"
},
{
"cve": "CVE-2023-0215",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
}
],
"references": [
{
"category": "self",
"summary": "CVE-2023-0215",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-0215.json"
}
],
"title": "CVE-2023-0215"
},
{
"cve": "CVE-2023-0286",
"cwe": {
"id": "CWE-704",
"name": "Incorrect Type Conversion or Cast"
},
"notes": [
{
"category": "other",
"text": "Incorrect Type Conversion or Cast",
"title": "CWE-704"
},
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
}
],
"references": [
{
"category": "self",
"summary": "CVE-2023-0286",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-0286.json"
}
],
"title": "CVE-2023-0286"
},
{
"cve": "CVE-2023-30533",
"references": [
{
"category": "self",
"summary": "CVE-2023-30533",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-30533.json"
}
],
"title": "CVE-2023-30533"
},
{
"cve": "CVE-2024-28166",
"cwe": {
"id": "CWE-434",
"name": "Unrestricted Upload of File with Dangerous Type"
},
"notes": [
{
"category": "other",
"text": "Unrestricted Upload of File with Dangerous Type",
"title": "CWE-434"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1475737",
"CSAFPID-1464457",
"CSAFPID-1464458",
"CSAFPID-55201",
"CSAFPID-55202",
"CSAFPID-955724",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-28166",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-28166.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-1475737",
"CSAFPID-1464457",
"CSAFPID-1464458",
"CSAFPID-55201",
"CSAFPID-55202",
"CSAFPID-955724",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-28166"
},
{
"cve": "CVE-2024-29415",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "other",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
}
],
"references": [
{
"category": "self",
"summary": "CVE-2024-29415",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29415.json"
}
],
"title": "CVE-2024-29415"
},
{
"cve": "CVE-2024-33003",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1614268",
"CSAFPID-1614269",
"CSAFPID-1614270",
"CSAFPID-1614271",
"CSAFPID-1614272",
"CSAFPID-1614273",
"CSAFPID-1614274",
"CSAFPID-1548429",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-33003",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-33003.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1614268",
"CSAFPID-1614269",
"CSAFPID-1614270",
"CSAFPID-1614271",
"CSAFPID-1614272",
"CSAFPID-1614273",
"CSAFPID-1614274",
"CSAFPID-1548429",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-33003"
},
{
"cve": "CVE-2024-33005",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1614243",
"CSAFPID-1614244",
"CSAFPID-1614245",
"CSAFPID-1614246",
"CSAFPID-1614247",
"CSAFPID-1614248",
"CSAFPID-1614249",
"CSAFPID-1614250",
"CSAFPID-1614251",
"CSAFPID-1614252",
"CSAFPID-1614253",
"CSAFPID-1614254",
"CSAFPID-1614255",
"CSAFPID-1614256",
"CSAFPID-1614257",
"CSAFPID-1614258",
"CSAFPID-1614259",
"CSAFPID-1614260",
"CSAFPID-1614261",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-33005",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-33005.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1614243",
"CSAFPID-1614244",
"CSAFPID-1614245",
"CSAFPID-1614246",
"CSAFPID-1614247",
"CSAFPID-1614248",
"CSAFPID-1614249",
"CSAFPID-1614250",
"CSAFPID-1614251",
"CSAFPID-1614252",
"CSAFPID-1614253",
"CSAFPID-1614254",
"CSAFPID-1614255",
"CSAFPID-1614256",
"CSAFPID-1614257",
"CSAFPID-1614258",
"CSAFPID-1614259",
"CSAFPID-1614260",
"CSAFPID-1614261",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-33005"
},
{
"cve": "CVE-2024-39591",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1475725",
"CSAFPID-1614203",
"CSAFPID-1614204",
"CSAFPID-1614205",
"CSAFPID-1614206",
"CSAFPID-1614207",
"CSAFPID-1614208",
"CSAFPID-1475732",
"CSAFPID-1614209",
"CSAFPID-1614210",
"CSAFPID-1614211",
"CSAFPID-1614212",
"CSAFPID-1611687",
"CSAFPID-1611685",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-39591",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39591.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1475725",
"CSAFPID-1614203",
"CSAFPID-1614204",
"CSAFPID-1614205",
"CSAFPID-1614206",
"CSAFPID-1614207",
"CSAFPID-1614208",
"CSAFPID-1475732",
"CSAFPID-1614209",
"CSAFPID-1614210",
"CSAFPID-1614211",
"CSAFPID-1614212",
"CSAFPID-1611687",
"CSAFPID-1611685",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-39591"
},
{
"cve": "CVE-2024-41730",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1614275",
"CSAFPID-1464458",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-41730",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41730.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1614275",
"CSAFPID-1464458",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-41730"
},
{
"cve": "CVE-2024-41731",
"cwe": {
"id": "CWE-434",
"name": "Unrestricted Upload of File with Dangerous Type"
},
"notes": [
{
"category": "other",
"text": "Unrestricted Upload of File with Dangerous Type",
"title": "CWE-434"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1475737",
"CSAFPID-1464457",
"CSAFPID-1464458",
"CSAFPID-55201",
"CSAFPID-55202",
"CSAFPID-955724",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-41731",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41731.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-1475737",
"CSAFPID-1464457",
"CSAFPID-1464458",
"CSAFPID-55201",
"CSAFPID-55202",
"CSAFPID-955724",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-41731"
},
{
"cve": "CVE-2024-41732",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "other",
"text": "Improper Access Control",
"title": "CWE-284"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1614229",
"CSAFPID-1559117",
"CSAFPID-1559118",
"CSAFPID-1614230",
"CSAFPID-1614231",
"CSAFPID-1614232",
"CSAFPID-1614233",
"CSAFPID-1614234",
"CSAFPID-1614235",
"CSAFPID-1614236",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-41732",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41732.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1614229",
"CSAFPID-1559117",
"CSAFPID-1559118",
"CSAFPID-1614230",
"CSAFPID-1614231",
"CSAFPID-1614232",
"CSAFPID-1614233",
"CSAFPID-1614234",
"CSAFPID-1614235",
"CSAFPID-1614236",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-41732"
},
{
"cve": "CVE-2024-41733",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1495975",
"CSAFPID-1495976",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-41733",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41733.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1495975",
"CSAFPID-1495976",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-41733"
},
{
"cve": "CVE-2024-41734",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1465636",
"CSAFPID-1614223",
"CSAFPID-1614224",
"CSAFPID-1465639",
"CSAFPID-1465640",
"CSAFPID-1465641",
"CSAFPID-1465642",
"CSAFPID-1465643",
"CSAFPID-1465644",
"CSAFPID-1465645",
"CSAFPID-1465646",
"CSAFPID-1465647",
"CSAFPID-1465648",
"CSAFPID-1614225",
"CSAFPID-1614226",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-41734",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41734.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1465636",
"CSAFPID-1614223",
"CSAFPID-1614224",
"CSAFPID-1465639",
"CSAFPID-1465640",
"CSAFPID-1465641",
"CSAFPID-1465642",
"CSAFPID-1465643",
"CSAFPID-1465644",
"CSAFPID-1465645",
"CSAFPID-1465646",
"CSAFPID-1465647",
"CSAFPID-1465648",
"CSAFPID-1614225",
"CSAFPID-1614226",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-41734"
},
{
"cve": "CVE-2024-41735",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1614262",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-41735",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41735.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1614262",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-41735"
},
{
"cve": "CVE-2024-41736",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1614227",
"CSAFPID-1614228",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-41736",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41736.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1614227",
"CSAFPID-1614228",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-41736"
},
{
"cve": "CVE-2024-41737",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "other",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1614237",
"CSAFPID-1614238",
"CSAFPID-1614239",
"CSAFPID-1614240",
"CSAFPID-1614241",
"CSAFPID-1614242",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-41737",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41737.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1614237",
"CSAFPID-1614238",
"CSAFPID-1614239",
"CSAFPID-1614240",
"CSAFPID-1614241",
"CSAFPID-1614242",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-41737"
},
{
"cve": "CVE-2024-42373",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1614213",
"CSAFPID-1614214",
"CSAFPID-1614215",
"CSAFPID-1614216",
"CSAFPID-1614217",
"CSAFPID-1614218",
"CSAFPID-1614219",
"CSAFPID-1614220",
"CSAFPID-1614221",
"CSAFPID-1475927",
"CSAFPID-1475928",
"CSAFPID-1475929",
"CSAFPID-1475930",
"CSAFPID-1475931",
"CSAFPID-1475932",
"CSAFPID-1475933",
"CSAFPID-1475934",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-42373",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-42373.json"
}
],
"title": "CVE-2024-42373"
},
{
"cve": "CVE-2024-42374",
"cwe": {
"id": "CWE-91",
"name": "XML Injection (aka Blind XPath Injection)"
},
"notes": [
{
"category": "other",
"text": "XML Injection (aka Blind XPath Injection)",
"title": "CWE-91"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1614276",
"CSAFPID-1614277",
"CSAFPID-1614278",
"CSAFPID-1614279",
"CSAFPID-1614280",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-42374",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-42374.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1614276",
"CSAFPID-1614277",
"CSAFPID-1614278",
"CSAFPID-1614279",
"CSAFPID-1614280",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-42374"
},
{
"cve": "CVE-2024-42375",
"cwe": {
"id": "CWE-434",
"name": "Unrestricted Upload of File with Dangerous Type"
},
"notes": [
{
"category": "other",
"text": "Unrestricted Upload of File with Dangerous Type",
"title": "CWE-434"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1475737",
"CSAFPID-1464457",
"CSAFPID-1464458",
"CSAFPID-55201",
"CSAFPID-55202",
"CSAFPID-955724",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-42375",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-42375.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1475737",
"CSAFPID-1464457",
"CSAFPID-1464458",
"CSAFPID-55201",
"CSAFPID-55202",
"CSAFPID-955724",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-42375"
},
{
"cve": "CVE-2024-42376",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1614263",
"CSAFPID-1614264",
"CSAFPID-1614265",
"CSAFPID-1614266",
"CSAFPID-1614267",
"CSAFPID-1498297"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-42376",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-42376.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1614263",
"CSAFPID-1614264",
"CSAFPID-1614265",
"CSAFPID-1614266",
"CSAFPID-1614267",
"CSAFPID-1498297"
]
}
],
"title": "CVE-2024-42376"
}
]
}
WID-SEC-W-2024-1818
Vulnerability from csaf_certbund - Published: 2024-08-12 22:00 - Updated: 2024-08-12 22:00Summary
SAP Security Patch Day – August 2024
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Angriff
Ein Angreifer kann mehrere Schwachstellen in der SAP-Software ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu löschen oder zu manipulieren oder einen Cross Site Scripting-Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "SAP stellt unternehmensweite L\u00f6sungen f\u00fcr Gesch\u00e4ftsprozesse wie Buchf\u00fchrung, Vertrieb, Einkauf und Lagerhaltung zur Verf\u00fcgung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in der SAP-Software ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross Site Scripting-Angriff durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-1818 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1818.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-1818 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1818"
},
{
"category": "external",
"summary": "SAP Patchday August 2024 vom 2024-08-12",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2024.html"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28166"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33003"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33005"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39591"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41730"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41731"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41732"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41733"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41734"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41735"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41736"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41737"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42373"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42374"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42375"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42376"
},
{
"category": "external",
"summary": "NIST Vulnerability Database vom 2024-08-12",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42377"
}
],
"source_lang": "en-US",
"title": "SAP Security Patch Day \u2013 August 2024",
"tracking": {
"current_release_date": "2024-08-12T22:00:00.000+00:00",
"generator": {
"date": "2024-08-15T18:12:11.333+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2024-1818",
"initial_release_date": "2024-08-12T22:00:00.000+00:00",
"revision_history": [
{
"date": "2024-08-12T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "SAP Software",
"product": {
"name": "SAP Software",
"product_id": "T036754",
"product_identification_helper": {
"cpe": "cpe:/a:sap:sap:-"
}
}
}
],
"category": "vendor",
"name": "SAP"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-28166",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-28166"
},
{
"cve": "CVE-2024-33003",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-33003"
},
{
"cve": "CVE-2024-33005",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-33005"
},
{
"cve": "CVE-2024-39591",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-39591"
},
{
"cve": "CVE-2024-41730",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-41730"
},
{
"cve": "CVE-2024-41731",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-41731"
},
{
"cve": "CVE-2024-41732",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-41732"
},
{
"cve": "CVE-2024-41733",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-41733"
},
{
"cve": "CVE-2024-41734",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-41734"
},
{
"cve": "CVE-2024-41735",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-41735"
},
{
"cve": "CVE-2024-41736",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-41736"
},
{
"cve": "CVE-2024-41737",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-41737"
},
{
"cve": "CVE-2024-42373",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-42373"
},
{
"cve": "CVE-2024-42374",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-42374"
},
{
"cve": "CVE-2024-42375",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-42375"
},
{
"cve": "CVE-2024-42376",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-42376"
},
{
"cve": "CVE-2024-42377",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in mehreren Komponenten wie dem Shared Service Framework, der Business Intelligence Platform oder dem ADS-System, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Autorisierung, einer unsachgem\u00e4\u00dfen Eingabevalidierung oder einer XML-Injektion. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu l\u00f6schen oder zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
}
],
"product_status": {
"known_affected": [
"T036754"
]
},
"release_date": "2024-08-12T22:00:00.000+00:00",
"title": "CVE-2024-42377"
}
]
}
WID-SEC-W-2024-3640
Vulnerability from csaf_certbund - Published: 2024-12-09 23:00 - Updated: 2024-12-09 23:00Summary
SAP Patchday Dezember 2024: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
SAP stellt unternehmensweite Lösungen für Geschäftsprozesse wie Buchführung, Vertrieb, Einkauf und Lagerhaltung zur Verfügung.
Angriff
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten zu verändern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen.
Betroffene Betriebssysteme
- Linux
- Sonstiges
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "SAP stellt unternehmensweite L\u00f6sungen f\u00fcr Gesch\u00e4ftsprozesse wie Buchf\u00fchrung, Vertrieb, Einkauf und Lagerhaltung zur Verf\u00fcgung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- Sonstiges\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-3640 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3640.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-3640 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3640"
},
{
"category": "external",
"summary": "SAP Patchday Dezember vom 2024-12-09",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2024.html"
}
],
"source_lang": "en-US",
"title": "SAP Patchday Dezember 2024: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2024-12-09T23:00:00.000+00:00",
"generator": {
"date": "2024-12-10T10:41:58.572+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.10"
}
},
"id": "WID-SEC-W-2024-3640",
"initial_release_date": "2024-12-09T23:00:00.000+00:00",
"revision_history": [
{
"date": "2024-12-09T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "SAP Software",
"product": {
"name": "SAP Software",
"product_id": "T032707",
"product_identification_helper": {
"cpe": "cpe:/a:sap:sap:-"
}
}
}
],
"category": "vendor",
"name": "SAP"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-28166",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-28166"
},
{
"cve": "CVE-2024-32732",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-32732"
},
{
"cve": "CVE-2024-41731",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-41731"
},
{
"cve": "CVE-2024-42375",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-42375"
},
{
"cve": "CVE-2024-47576",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-47576"
},
{
"cve": "CVE-2024-47577",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-47577"
},
{
"cve": "CVE-2024-47578",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-47578"
},
{
"cve": "CVE-2024-47581",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-47581"
},
{
"cve": "CVE-2024-47582",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-47582"
},
{
"cve": "CVE-2024-47585",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-47585"
},
{
"cve": "CVE-2024-47586",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-47586"
},
{
"cve": "CVE-2024-47590",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-47590"
},
{
"cve": "CVE-2024-54197",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-54197"
},
{
"cve": "CVE-2024-54198",
"notes": [
{
"category": "description",
"text": "In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungspr\u00fcfung oder einer unsachgem\u00e4\u00dfen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Daten zu ver\u00e4ndern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T032707"
]
},
"release_date": "2024-12-09T23:00:00.000+00:00",
"title": "CVE-2024-54198"
}
]
}
GHSA-F2GW-3CQW-XMJ7
Vulnerability from github – Published: 2024-08-13 06:30 – Updated: 2024-12-10 09:31
VLAI?
Details
SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application.
Severity ?
{
"affected": [],
"aliases": [
"CVE-2024-28166"
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T04:15:06Z",
"severity": "LOW"
},
"details": "SAP BusinessObjects Business Intelligence\n Platform allows an authenticated attacker to upload malicious code over the\n network, that could be executed by the application. On successful\n exploitation, the attacker can cause a low impact on the Integrity of the\n application.",
"id": "GHSA-f2gw-3cqw-xmj7",
"modified": "2024-12-10T09:31:18Z",
"published": "2024-08-13T06:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28166"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3433545"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3515653"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…