csaf_ncscnl - ncsc-2024-0247

Vulnerability from csaf_ncscnl

Published

2024-06-11 12:37

Modified

2024-06-11 12:37

Summary

Kwetsbaarheden verholpen in SAP producten

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

SAP heeft kwetsbaarheden verholpen in diverse SAP producten, zoals Business Objects, HANA, CRM en NetWeaver.

Interpretaties

Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: - Denial-of-Service (DoS) - Omzeilen van authenticatie - Cross-Site-Scripting (XSS) - Manipulatie van gegevens - Toegang tot gevoelige gegevens

Oplossingen

SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen in de kwetsbare producten. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-400

Uncontrolled Resource Consumption

CWE-434

Unrestricted Upload of File with Dangerous Type

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-862

Missing Authorization

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "SAP heeft kwetsbaarheden verholpen in diverse SAP producten, zoals Business Objects, HANA, CRM en NetWeaver.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Denial-of-Service (DoS)\n- Omzeilen van authenticatie\n- Cross-Site-Scripting (XSS)\n- Manipulatie van gegevens\n- Toegang tot gevoelige gegevens",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen in de kwetsbare producten. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Unrestricted Upload of File with Dangerous Type",
        "title": "CWE-434"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      },
      {
        "category": "general",
        "text": "Missing Authorization",
        "title": "CWE-862"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Source - sap",
        "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2024.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in SAP producten",
    "tracking": {
      "current_release_date": "2024-06-11T12:37:09.525507Z",
      "id": "NCSC-2024-0247",
      "initial_release_date": "2024-06-11T12:37:09.525507Z",
      "revision_history": [
        {
          "date": "2024-06-11T12:37:09.525507Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "sap_businessobjects_business_intelligence_platform",
            "product": {
              "name": "sap_businessobjects_business_intelligence_platform",
              "product_id": "CSAFPID-1464457",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_businessobjects_business_intelligence_platform:430:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_businessobjects_business_intelligence_platform",
            "product": {
              "name": "sap_businessobjects_business_intelligence_platform",
              "product_id": "CSAFPID-1464458",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_businessobjects_business_intelligence_platform:440:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_businessobjects_business_intelligence_platform",
            "product": {
              "name": "sap_businessobjects_business_intelligence_platform",
              "product_id": "CSAFPID-1475737",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_businessobjects_business_intelligence_platform:enterprise_420:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475771",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:300:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475772",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:400:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475775",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:750:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475776",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:751:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475777",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:752:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475778",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:753:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475779",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:754:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475780",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:755:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475781",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:756:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475782",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:757:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475783",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:758:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475773",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:796:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475770",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:dw4core_200:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_bw_4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "sap_bw_4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475774",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_bw_4hana_transformation_and_data_transfer_process:sap_bw_740:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475739",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:103:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475740",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:104:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475741",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:105:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475742",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:106:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475743",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:107:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475745",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:701:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475746",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:730:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475747",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:731:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475748",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:746:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475749",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:747:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475750",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:748:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475751",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:800:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475752",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:801:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475738",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:s4fnd_102:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_crm_webclient_ui",
            "product": {
              "name": "sap_crm_webclient_ui",
              "product_id": "CSAFPID-1475744",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_crm_webclient_ui:webcuif_700:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475724",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:101:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475726",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:103:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475727",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:104:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475728",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:105:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475729",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:106:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475730",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:107:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475731",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:108:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475733",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:731:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475734",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:746:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475735",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:747:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475736",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:748:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475723",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:s4core_100:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475725",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:s4fnd_102:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_document_builder",
            "product": {
              "name": "sap_document_builder",
              "product_id": "CSAFPID-1475732",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_document_builder:sap_bs_fnd_702:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_financial_consolidation",
            "product": {
              "name": "sap_financial_consolidation",
              "product_id": "CSAFPID-1475785",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_financial_consolidation:finance_1010:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_netweaver_and_abap_platform",
            "product": {
              "name": "sap_netweaver_and_abap_platform",
              "product_id": "CSAFPID-1475721",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_netweaver_and_abap_platform:2008_1_710:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_netweaver_and_abap_platform",
            "product": {
              "name": "sap_netweaver_and_abap_platform",
              "product_id": "CSAFPID-1475722",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_netweaver_and_abap_platform:740:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_netweaver_and_abap_platform",
            "product": {
              "name": "sap_netweaver_and_abap_platform",
              "product_id": "CSAFPID-1475720",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_netweaver_and_abap_platform:st-pi_2008_1_700:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_netweaver_as_java",
            "product": {
              "name": "sap_netweaver_as_java",
              "product_id": "CSAFPID-1475717",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_netweaver_as_java:gp-core_7.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_netweaver_as_java",
            "product": {
              "name": "sap_netweaver_as_java",
              "product_id": "CSAFPID-1475753",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_netweaver_as_java:mmr_server_7.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_s_4hana__manage_incoming_payment_files_",
            "product": {
              "name": "sap_s_4hana__manage_incoming_payment_files_",
              "product_id": "CSAFPID-1475764",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_s_4hana__manage_incoming_payment_files_:103:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_s_4hana__manage_incoming_payment_files_",
            "product": {
              "name": "sap_s_4hana__manage_incoming_payment_files_",
              "product_id": "CSAFPID-1475765",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_s_4hana__manage_incoming_payment_files_:104:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_s_4hana__manage_incoming_payment_files_",
            "product": {
              "name": "sap_s_4hana__manage_incoming_payment_files_",
              "product_id": "CSAFPID-1475766",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_s_4hana__manage_incoming_payment_files_:105:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_s_4hana__manage_incoming_payment_files_",
            "product": {
              "name": "sap_s_4hana__manage_incoming_payment_files_",
              "product_id": "CSAFPID-1475767",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_s_4hana__manage_incoming_payment_files_:106:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_s_4hana__manage_incoming_payment_files_",
            "product": {
              "name": "sap_s_4hana__manage_incoming_payment_files_",
              "product_id": "CSAFPID-1475768",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_s_4hana__manage_incoming_payment_files_:107:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_s_4hana__manage_incoming_payment_files_",
            "product": {
              "name": "sap_s_4hana__manage_incoming_payment_files_",
              "product_id": "CSAFPID-1475769",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_s_4hana__manage_incoming_payment_files_:108:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_s_4hana__manage_incoming_payment_files_",
            "product": {
              "name": "sap_s_4hana__manage_incoming_payment_files_",
              "product_id": "CSAFPID-1475763",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_s_4hana__manage_incoming_payment_files_:s4core_102:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_student_life_cycle_management",
            "product": {
              "name": "sap_student_life_cycle_management",
              "product_id": "CSAFPID-1475755",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management:618:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_student_life_cycle_management",
            "product": {
              "name": "sap_student_life_cycle_management",
              "product_id": "CSAFPID-1475756",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management:802:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_student_life_cycle_management",
            "product": {
              "name": "sap_student_life_cycle_management",
              "product_id": "CSAFPID-1475757",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management:803:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_student_life_cycle_management",
            "product": {
              "name": "sap_student_life_cycle_management",
              "product_id": "CSAFPID-1475758",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management:804:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_student_life_cycle_management",
            "product": {
              "name": "sap_student_life_cycle_management",
              "product_id": "CSAFPID-1475759",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management:805:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_student_life_cycle_management",
            "product": {
              "name": "sap_student_life_cycle_management",
              "product_id": "CSAFPID-1475760",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management:806:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_student_life_cycle_management",
            "product": {
              "name": "sap_student_life_cycle_management",
              "product_id": "CSAFPID-1475761",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management:807:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_student_life_cycle_management",
            "product": {
              "name": "sap_student_life_cycle_management",
              "product_id": "CSAFPID-1475762",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management:808:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "sap_student_life_cycle_management",
            "product": {
              "name": "sap_student_life_cycle_management",
              "product_id": "CSAFPID-1475754",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap_se:sap_student_life_cycle_management:is-ps-ca_617:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "sap_se"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "bw4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "bw4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475905",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:bw4hana_transformation_and_data_transfer_process:300:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bw4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "bw4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475910",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:bw4hana_transformation_and_data_transfer_process:400:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bw4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "bw4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475906",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:bw4hana_transformation_and_data_transfer_process:750:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bw4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "bw4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475914",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:bw4hana_transformation_and_data_transfer_process:751:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bw4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "bw4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475915",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:bw4hana_transformation_and_data_transfer_process:752:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bw4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "bw4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475912",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:bw4hana_transformation_and_data_transfer_process:753:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bw4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "bw4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475913",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:bw4hana_transformation_and_data_transfer_process:754:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bw4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "bw4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475904",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:bw4hana_transformation_and_data_transfer_process:755:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bw4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "bw4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475909",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:bw4hana_transformation_and_data_transfer_process:756:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bw4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "bw4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475908",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:bw4hana_transformation_and_data_transfer_process:757:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bw4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "bw4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475911",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:bw4hana_transformation_and_data_transfer_process:758:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "bw4hana_transformation_and_data_transfer_process",
            "product": {
              "name": "bw4hana_transformation_and_data_transfer_process",
              "product_id": "CSAFPID-1475907",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:bw4hana_transformation_and_data_transfer_process:796:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475899",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:103:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475903",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:104:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475898",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:105:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475895",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:106:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475892",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:107:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475896",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:701:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475902",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:730:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475897",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:731:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475900",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:746:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475894",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:747:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475893",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:748:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475901",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:800:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "crm_webclient_ui",
            "product": {
              "name": "crm_webclient_ui",
              "product_id": "CSAFPID-1475891",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:crm_webclient_ui:801:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "document_builder",
            "product": {
              "name": "document_builder",
              "product_id": "CSAFPID-1475919",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:document_builder:101:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "document_builder",
            "product": {
              "name": "document_builder",
              "product_id": "CSAFPID-1475925",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:document_builder:103:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "document_builder",
            "product": {
              "name": "document_builder",
              "product_id": "CSAFPID-1475923",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:document_builder:104:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "document_builder",
            "product": {
              "name": "document_builder",
              "product_id": "CSAFPID-1475920",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:document_builder:105:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "document_builder",
            "product": {
              "name": "document_builder",
              "product_id": "CSAFPID-1475916",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:document_builder:106:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "document_builder",
            "product": {
              "name": "document_builder",
              "product_id": "CSAFPID-1475924",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:document_builder:107:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "document_builder",
            "product": {
              "name": "document_builder",
              "product_id": "CSAFPID-1475926",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:document_builder:108:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "document_builder",
            "product": {
              "name": "document_builder",
              "product_id": "CSAFPID-1475922",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:document_builder:731:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "document_builder",
            "product": {
              "name": "document_builder",
              "product_id": "CSAFPID-1475917",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:document_builder:746:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "document_builder",
            "product": {
              "name": "document_builder",
              "product_id": "CSAFPID-1475918",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:document_builder:747:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "document_builder",
            "product": {
              "name": "document_builder",
              "product_id": "CSAFPID-1475921",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:document_builder:748:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "financial_consolidation",
            "product": {
              "name": "financial_consolidation",
              "product_id": "CSAFPID-485342",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:financial_consolidation:1010:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "netweaver_application_server_abap",
            "product": {
              "name": "netweaver_application_server_abap",
              "product_id": "CSAFPID-173007",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "netweaver_application_server_abap",
            "product": {
              "name": "netweaver_application_server_abap",
              "product_id": "CSAFPID-175015",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "netweaver_application_server_abap",
            "product": {
              "name": "netweaver_application_server_abap",
              "product_id": "CSAFPID-74446",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "netweaver_as_java",
            "product": {
              "name": "netweaver_as_java",
              "product_id": "CSAFPID-1475935",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:netweaver_as_java:7.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "student_life_cycle_management",
            "product": {
              "name": "student_life_cycle_management",
              "product_id": "CSAFPID-1475930",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:student_life_cycle_management:618:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "student_life_cycle_management",
            "product": {
              "name": "student_life_cycle_management",
              "product_id": "CSAFPID-1475932",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:student_life_cycle_management:802:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "student_life_cycle_management",
            "product": {
              "name": "student_life_cycle_management",
              "product_id": "CSAFPID-1475933",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:student_life_cycle_management:803:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "student_life_cycle_management",
            "product": {
              "name": "student_life_cycle_management",
              "product_id": "CSAFPID-1475927",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:student_life_cycle_management:804:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "student_life_cycle_management",
            "product": {
              "name": "student_life_cycle_management",
              "product_id": "CSAFPID-1475931",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:student_life_cycle_management:805:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "student_life_cycle_management",
            "product": {
              "name": "student_life_cycle_management",
              "product_id": "CSAFPID-1475928",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:student_life_cycle_management:806:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "student_life_cycle_management",
            "product": {
              "name": "student_life_cycle_management",
              "product_id": "CSAFPID-1475934",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:student_life_cycle_management:807:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "student_life_cycle_management",
            "product": {
              "name": "student_life_cycle_management",
              "product_id": "CSAFPID-1475929",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:sap:student_life_cycle_management:808:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "sap"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-37177",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1475785",
          "CSAFPID-485342"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-37177",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-37177.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1475785",
            "CSAFPID-485342"
          ]
        }
      ],
      "title": "CVE-2024-37177"
    },
    {
      "cve": "CVE-2024-34688",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1475753"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-34688",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-34688.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1475753"
          ]
        }
      ],
      "title": "CVE-2024-34688"
    },
    {
      "cve": "CVE-2024-33001",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1475720",
          "CSAFPID-1475721",
          "CSAFPID-1475722",
          "CSAFPID-74446",
          "CSAFPID-173007"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-33001",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-33001.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1475720",
            "CSAFPID-1475721",
            "CSAFPID-1475722",
            "CSAFPID-74446",
            "CSAFPID-173007"
          ]
        }
      ],
      "title": "CVE-2024-33001"
    },
    {
      "cve": "CVE-2024-34683",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "notes": [
        {
          "category": "other",
          "text": "Unrestricted Upload of File with Dangerous Type",
          "title": "CWE-434"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1475723",
          "CSAFPID-1475724",
          "CSAFPID-1475725",
          "CSAFPID-1475726",
          "CSAFPID-1475727",
          "CSAFPID-1475728",
          "CSAFPID-1475729",
          "CSAFPID-1475730",
          "CSAFPID-1475731",
          "CSAFPID-1475732",
          "CSAFPID-1475733",
          "CSAFPID-1475734",
          "CSAFPID-1475735",
          "CSAFPID-1475736"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-34683",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-34683.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1475723",
            "CSAFPID-1475724",
            "CSAFPID-1475725",
            "CSAFPID-1475726",
            "CSAFPID-1475727",
            "CSAFPID-1475728",
            "CSAFPID-1475729",
            "CSAFPID-1475730",
            "CSAFPID-1475731",
            "CSAFPID-1475732",
            "CSAFPID-1475733",
            "CSAFPID-1475734",
            "CSAFPID-1475735",
            "CSAFPID-1475736"
          ]
        }
      ],
      "title": "CVE-2024-34683"
    },
    {
      "cve": "CVE-2024-34691",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Authorization",
          "title": "CWE-862"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1475763",
          "CSAFPID-1475764",
          "CSAFPID-1475765",
          "CSAFPID-1475766",
          "CSAFPID-1475767",
          "CSAFPID-1475768",
          "CSAFPID-1475769"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-34691",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-34691.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1475763",
            "CSAFPID-1475764",
            "CSAFPID-1475765",
            "CSAFPID-1475766",
            "CSAFPID-1475767",
            "CSAFPID-1475768",
            "CSAFPID-1475769"
          ]
        }
      ],
      "title": "CVE-2024-34691"
    },
    {
      "cve": "CVE-2024-34686",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1475738",
          "CSAFPID-1475739",
          "CSAFPID-1475740",
          "CSAFPID-1475741",
          "CSAFPID-1475742",
          "CSAFPID-1475743",
          "CSAFPID-1475744",
          "CSAFPID-1475745",
          "CSAFPID-1475746",
          "CSAFPID-1475747",
          "CSAFPID-1475748",
          "CSAFPID-1475749",
          "CSAFPID-1475750",
          "CSAFPID-1475751",
          "CSAFPID-1475752"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-34686",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-34686.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1475738",
            "CSAFPID-1475739",
            "CSAFPID-1475740",
            "CSAFPID-1475741",
            "CSAFPID-1475742",
            "CSAFPID-1475743",
            "CSAFPID-1475744",
            "CSAFPID-1475745",
            "CSAFPID-1475746",
            "CSAFPID-1475747",
            "CSAFPID-1475748",
            "CSAFPID-1475749",
            "CSAFPID-1475750",
            "CSAFPID-1475751",
            "CSAFPID-1475752"
          ]
        }
      ],
      "title": "CVE-2024-34686"
    },
    {
      "cve": "CVE-2024-37176",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Authorization",
          "title": "CWE-862"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1475770",
          "CSAFPID-1475771",
          "CSAFPID-1475772",
          "CSAFPID-1475773",
          "CSAFPID-1475774",
          "CSAFPID-1475775",
          "CSAFPID-1475776",
          "CSAFPID-1475777",
          "CSAFPID-1475778",
          "CSAFPID-1475779",
          "CSAFPID-1475780",
          "CSAFPID-1475781",
          "CSAFPID-1475782",
          "CSAFPID-1475783"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-37176",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-37176.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1475770",
            "CSAFPID-1475771",
            "CSAFPID-1475772",
            "CSAFPID-1475773",
            "CSAFPID-1475774",
            "CSAFPID-1475775",
            "CSAFPID-1475776",
            "CSAFPID-1475777",
            "CSAFPID-1475778",
            "CSAFPID-1475779",
            "CSAFPID-1475780",
            "CSAFPID-1475781",
            "CSAFPID-1475782",
            "CSAFPID-1475783"
          ]
        }
      ],
      "title": "CVE-2024-37176"
    },
    {
      "cve": "CVE-2024-34690",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Authorization",
          "title": "CWE-862"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1475754",
          "CSAFPID-1475755",
          "CSAFPID-1475756",
          "CSAFPID-1475757",
          "CSAFPID-1475758",
          "CSAFPID-1475759",
          "CSAFPID-1475760",
          "CSAFPID-1475761",
          "CSAFPID-1475762"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-34690",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-34690.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1475754",
            "CSAFPID-1475755",
            "CSAFPID-1475756",
            "CSAFPID-1475757",
            "CSAFPID-1475758",
            "CSAFPID-1475759",
            "CSAFPID-1475760",
            "CSAFPID-1475761",
            "CSAFPID-1475762"
          ]
        }
      ],
      "title": "CVE-2024-34690"
    },
    {
      "cve": "CVE-2024-28164",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1475717"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-28164",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-28164.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1475717"
          ]
        }
      ],
      "title": "CVE-2024-28164"
    },
    {
      "cve": "CVE-2024-34684",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1475737",
          "CSAFPID-1464457",
          "CSAFPID-1464458"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-34684",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-34684.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1475737",
            "CSAFPID-1464457",
            "CSAFPID-1464458"
          ]
        }
      ],
      "title": "CVE-2024-34684"
    }
  ]
}

cve-2024-34683

Vulnerability from cvelistv5

Published

2024-06-11 02:08

Modified

2024-08-02 02:59

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Summary

An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victim’s browser.

References

▼	URL	Tags
	https://me.sap.com/notes/3459379
	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Impacted products

Vendor

Product

Version

▼

SAP_SE

SAP Document Builder

Version: S4CORE 100
Version: 101
Version: S4FND 102
Version: 103
Version: 104
Version: 105
Version: 106
Version: 107
Version: 108
Version: SAP_BS_FND 702
Version: 731
Version: 746
Version: 747
Version: 748

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-34683",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-11T13:35:39.111955Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-11T13:35:47.339Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:59:22.208Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3459379"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Document Builder",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "S4CORE 100"
            },
            {
              "status": "affected",
              "version": "101"
            },
            {
              "status": "affected",
              "version": "S4FND 102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            },
            {
              "status": "affected",
              "version": "107"
            },
            {
              "status": "affected",
              "version": "108"
            },
            {
              "status": "affected",
              "version": "SAP_BS_FND 702"
            },
            {
              "status": "affected",
              "version": "731"
            },
            {
              "status": "affected",
              "version": "746"
            },
            {
              "status": "affected",
              "version": "747"
            },
            {
              "status": "affected",
              "version": "748"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An authenticated attacker can upload malicious\nfile to SAP Document Builder service. When the victim accesses this file, the\nattacker is allowed to access, modify, or make the related information\nunavailable in the victim\u2019s browser.\n\n\n\n"
            }
          ],
          "value": "An authenticated attacker can upload malicious\nfile to SAP Document Builder service. When the victim accesses this file, the\nattacker is allowed to access, modify, or make the related information\nunavailable in the victim\u2019s browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-11T02:08:47.200Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3459379"
        },
        {
          "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unrestricted file upload in SAP Document Builder (HTTP service)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-34683",
    "datePublished": "2024-06-11T02:08:47.200Z",
    "dateReserved": "2024-05-07T05:46:11.656Z",
    "dateUpdated": "2024-08-02T02:59:22.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-28164

Vulnerability from cvelistv5

Published

2024-06-11 02:18

Modified

2024-08-02 00:48

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low impact on confidentiality of the application.

References

▼	URL	Tags
	https://me.sap.com/notes/3425571
	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Impacted products

Vendor

Product

Version

▼

SAP_SE

SAP NetWeaver AS Java

Version: GP-CORE 7.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sap:netweaver:7.50:*:*:*:java_as:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netweaver",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "7.50"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-28164",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-28T15:00:57.290351Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-03T16:44:43.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:48:49.198Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3425571"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver AS Java",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "GP-CORE 7.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SAP NetWeaver AS Java (CAF - Guided Procedures)\nallows an unauthenticated user to access non-sensitive information about the\nserver which would otherwise be restricted causing low impact on\nconfidentiality of the application."
            }
          ],
          "value": "SAP NetWeaver AS Java (CAF - Guided Procedures)\nallows an unauthenticated user to access non-sensitive information about the\nserver which would otherwise be restricted causing low impact on\nconfidentiality of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-11T10:10:35.316Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3425571"
        },
        {
          "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-28164",
    "datePublished": "2024-06-11T02:18:48.019Z",
    "dateReserved": "2024-03-06T06:12:27.005Z",
    "dateUpdated": "2024-08-02T00:48:49.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-34691

Vulnerability from cvelistv5

Published

2024-06-11 02:22

Modified

2024-08-02 02:59

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact on integrity and no impact on the confidentiality and availability of the system.

References

▼	URL	Tags
	https://me.sap.com/notes/3466175
	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Impacted products

Vendor

Product

Version

▼

SAP_SE

SAP S/4HANA (Manage Incoming Payment Files)

Version: S4CORE 102
Version: 103
Version: 104
Version: 105
Version: 106
Version: 107
Version: 108

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sap:s4hana:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "s4hana",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "102"
              },
              {
                "status": "affected",
                "version": "103"
              },
              {
                "status": "affected",
                "version": "104"
              },
              {
                "status": "affected",
                "version": "105"
              },
              {
                "status": "affected",
                "version": "106"
              },
              {
                "status": "affected",
                "version": "107"
              },
              {
                "status": "affected",
                "version": "108"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-34691",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-11T14:10:07.910208Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-31T19:55:18.143Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:59:22.219Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3466175"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP S/4HANA (Manage Incoming Payment Files)",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "S4CORE 102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            },
            {
              "status": "affected",
              "version": "107"
            },
            {
              "status": "affected",
              "version": "108"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Manage Incoming Payment Files (F1680) of SAP\nS/4HANA does not perform necessary authorization checks for an authenticated\nuser, resulting in escalation of privileges. As a result, it has high impact on\nintegrity and no impact on the confidentiality and availability of the system.\n\n\n\n"
            }
          ],
          "value": "Manage Incoming Payment Files (F1680) of SAP\nS/4HANA does not perform necessary authorization checks for an authenticated\nuser, resulting in escalation of privileges. As a result, it has high impact on\nintegrity and no impact on the confidentiality and availability of the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-11T02:22:24.435Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3466175"
        },
        {
          "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-34691",
    "datePublished": "2024-06-11T02:22:24.435Z",
    "dateReserved": "2024-05-07T05:46:11.658Z",
    "dateUpdated": "2024-08-02T02:59:22.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-37177

Vulnerability from cvelistv5

Published

2024-06-11 01:58

Modified

2024-08-02 03:50

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Summary

SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause significant impact to confidentiality and integrity of the application.

References

▼	URL	Tags
	https://me.sap.com/notes/3457592
	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Impacted products

Vendor

Product

Version

▼

SAP_SE

SAP Financial Consolidation

Version: FINANCE 1010

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sap:financial_consolidation:1010:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "financial_consolidation",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "1010"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-37177",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-11T17:51:55.904409Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-11T17:52:04.447Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:50:55.219Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3457592"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Financial Consolidation",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "FINANCE 1010"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SAP Financial Consolidation allows data to enter\na Web application through an untrusted source. These endpoints are exposed over\nthe network and it allows the user to modify the content from the web site. On\nsuccessful exploitation, an attacker can cause significant impact to\nconfidentiality and integrity of the application.\n\n\n\n"
            }
          ],
          "value": "SAP Financial Consolidation allows data to enter\na Web application through an untrusted source. These endpoints are exposed over\nthe network and it allows the user to modify the content from the web site. On\nsuccessful exploitation, an attacker can cause significant impact to\nconfidentiality and integrity of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-11T01:58:36.889Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3457592"
        },
        {
          "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-37177",
    "datePublished": "2024-06-11T01:58:36.889Z",
    "dateReserved": "2024-06-04T07:49:42.492Z",
    "dateUpdated": "2024-08-02T03:50:55.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-34686

Vulnerability from cvelistv5

Published

2024-06-11 02:11

Modified

2024-08-02 02:59

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application.

References

▼	URL	Tags
	https://me.sap.com/notes/3465129
	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Impacted products

Vendor

Product

Version

▼

SAP_SE

SAP CRM WebClient UI

Version: S4FND 102
Version: 103
Version: 104
Version: 105
Version: 106
Version: 107
Version: WEBCUIF 700
Version: 701
Version: 730
Version: 731
Version: 746
Version: 747
Version: 748
Version: 800
Version: 801

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_crm_webclient_ui:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sap_crm_webclient_ui",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "S4FND 102"
              },
              {
                "status": "affected",
                "version": "103"
              },
              {
                "status": "affected",
                "version": "104"
              },
              {
                "status": "affected",
                "version": "105"
              },
              {
                "status": "affected",
                "version": "106"
              },
              {
                "status": "affected",
                "version": "107"
              },
              {
                "status": "affected",
                "version": "WEBCUIF 700"
              },
              {
                "status": "affected",
                "version": "701"
              },
              {
                "status": "affected",
                "version": "730"
              },
              {
                "status": "affected",
                "version": "731"
              },
              {
                "status": "affected",
                "version": "746"
              },
              {
                "status": "affected",
                "version": "747"
              },
              {
                "status": "affected",
                "version": "748"
              },
              {
                "status": "affected",
                "version": "800"
              },
              {
                "status": "affected",
                "version": "801"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-34686",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-11T13:30:24.401872Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-11T13:41:52.606Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:59:22.207Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3465129"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP CRM WebClient UI",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "S4FND 102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            },
            {
              "status": "affected",
              "version": "107"
            },
            {
              "status": "affected",
              "version": "WEBCUIF 700"
            },
            {
              "status": "affected",
              "version": "701"
            },
            {
              "status": "affected",
              "version": "730"
            },
            {
              "status": "affected",
              "version": "731"
            },
            {
              "status": "affected",
              "version": "746"
            },
            {
              "status": "affected",
              "version": "747"
            },
            {
              "status": "affected",
              "version": "748"
            },
            {
              "status": "affected",
              "version": "800"
            },
            {
              "status": "affected",
              "version": "801"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Due to insufficient input validation, SAP CRM\nWebClient UI allows an unauthenticated attacker to craft a URL link which\nembeds a malicious script. When a victim clicks on this link, the script will\nbe executed in the victim\u0027s browser giving the attacker the ability to access\nand/or modify information with no effect on availability of the application.\n\n\n\n"
            }
          ],
          "value": "Due to insufficient input validation, SAP CRM\nWebClient UI allows an unauthenticated attacker to craft a URL link which\nembeds a malicious script. When a victim clicks on this link, the script will\nbe executed in the victim\u0027s browser giving the attacker the ability to access\nand/or modify information with no effect on availability of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-11T02:11:49.630Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3465129"
        },
        {
          "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-34686",
    "datePublished": "2024-06-11T02:11:49.630Z",
    "dateReserved": "2024-05-07T05:46:11.657Z",
    "dateUpdated": "2024-08-02T02:59:22.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-34690

Vulnerability from cvelistv5

Published

2024-06-11 02:17

Modified

2024-08-02 02:59

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to access and edit non-sensitive report variants that are typically restricted, causing minimal impact on the confidentiality and integrity of the application.

References

▼	URL	Tags
	https://me.sap.com/notes/3457265
	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Impacted products

Vendor

Product

Version

▼

SAP_SE

SAP Student Life Cycle Management

Version: IS-PS-CA 617
Version: 618
Version: 802
Version: 803
Version: 804
Version: 805
Version: 806
Version: 807
Version: 808

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-34690",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-11T14:23:21.338497Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-11T14:23:56.078Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:59:21.880Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3457265"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Student Life Cycle Management",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "IS-PS-CA 617"
            },
            {
              "status": "affected",
              "version": "618"
            },
            {
              "status": "affected",
              "version": "802"
            },
            {
              "status": "affected",
              "version": "803"
            },
            {
              "status": "affected",
              "version": "804"
            },
            {
              "status": "affected",
              "version": "805"
            },
            {
              "status": "affected",
              "version": "806"
            },
            {
              "status": "affected",
              "version": "807"
            },
            {
              "status": "affected",
              "version": "808"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SAP Student Life Cycle\nManagement (SLcM) fails to conduct proper authorization checks for\nauthenticated users, leading to the potential escalation of privileges. On\nsuccessful exploitation it could allow an attacker to access and edit\nnon-sensitive report variants that are typically restricted, causing minimal\nimpact on the confidentiality and integrity of the application."
            }
          ],
          "value": "SAP Student Life Cycle\nManagement (SLcM) fails to conduct proper authorization checks for\nauthenticated users, leading to the potential escalation of privileges. On\nsuccessful exploitation it could allow an attacker to access and edit\nnon-sensitive report variants that are typically restricted, causing minimal\nimpact on the confidentiality and integrity of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-11T10:13:28.806Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3457265"
        },
        {
          "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing Authorization check in SAP Student Life Cycle Management (SLcM)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-34690",
    "datePublished": "2024-06-11T02:17:13.787Z",
    "dateReserved": "2024-05-07T05:46:11.658Z",
    "dateUpdated": "2024-08-02T02:59:21.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-34684

Vulnerability from cvelistv5

Published

2024-06-11 02:20

Modified

2024-08-02 02:59

Severity ?

3.7 (Low) - CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

Summary

On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to access the password of a local account. As a result, an attacker can obtain non-administrative user credentials, which will allow them to read or modify the remote server files.

References

▼	URL	Tags
	https://me.sap.com/notes/3441817
	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Impacted products

Vendor

Product

Version

▼

SAP_SE

SAP BusinessObjects Business Intelligence Platform

Version: ENTERPRISE 420
Version: 430
Version: 440

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-34684",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-11T15:54:46.187310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-11T15:54:55.656Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:59:21.825Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3441817"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP BusinessObjects Business Intelligence Platform",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "ENTERPRISE 420"
            },
            {
              "status": "affected",
              "version": "430"
            },
            {
              "status": "affected",
              "version": "440"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "On Unix, SAP BusinessObjects Business\nIntelligence Platform (Scheduling) allows an authenticated attacker with\nadministrator access on the local server to access the password of a local\naccount. As a result, an attacker can obtain non-administrative user\ncredentials, which will allow them to read or modify the remote server files.\n\n\n\n"
            }
          ],
          "value": "On Unix, SAP BusinessObjects Business\nIntelligence Platform (Scheduling) allows an authenticated attacker with\nadministrator access on the local server to access the password of a local\naccount. As a result, an attacker can obtain non-administrative user\ncredentials, which will allow them to read or modify the remote server files."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-11T02:20:31.354Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3441817"
        },
        {
          "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Scheduling)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-34684",
    "datePublished": "2024-06-11T02:20:31.354Z",
    "dateReserved": "2024-05-07T05:46:11.657Z",
    "dateUpdated": "2024-08-02T02:59:21.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-34688

Vulnerability from cvelistv5

Published

2024-06-11 02:02

Modified

2024-08-02 02:59

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users from accessing it. This can result in no impact on confidentiality and integrity but a high impact on the availability of the application.

References

▼	URL	Tags
	https://me.sap.com/notes/3460407
	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Impacted products

Vendor

Product

Version

▼

SAP_SE

SAP NetWeaver AS Java

Version: MMR_SERVER 7.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sap:netweaver:7.50:*:*:*:java_as:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netweaver",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "7.50"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-34688",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-11T13:36:48.543897Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-11T13:40:34.530Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:59:22.017Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3460407"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver AS Java",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "MMR_SERVER 7.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Due to unrestricted access to the Meta Model\nRepository services in SAP NetWeaver AS Java, attackers can perform DoS attacks\non the application, which may prevent legitimate users from accessing it. This\ncan result in no impact on confidentiality and integrity but a high impact on\nthe availability of the application."
            }
          ],
          "value": "Due to unrestricted access to the Meta Model\nRepository services in SAP NetWeaver AS Java, attackers can perform DoS attacks\non the application, which may prevent legitimate users from accessing it. This\ncan result in no impact on confidentiality and integrity but a high impact on\nthe availability of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-11T10:12:32.680Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3460407"
        },
        {
          "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-34688",
    "datePublished": "2024-06-11T02:02:21.587Z",
    "dateReserved": "2024-05-07T05:46:11.658Z",
    "dateUpdated": "2024-08-02T02:59:22.017Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-33001

Vulnerability from cvelistv5

Published

2024-06-11 02:05

Modified

2024-08-02 02:27

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial of Service vulnerability might be long response delays and service interruptions, thus degrading the service quality experienced by legitimate users causing high impact on availability of the application.

References

▼	URL	Tags
	https://me.sap.com/notes/3453170
	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Impacted products

Vendor

Product

Version

▼

SAP_SE

SAP NetWeaver and ABAP platform

Version: ST-PI 2008_1_700
Version: 2008_1_710
Version: 740

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_netweaver_and_abap_platform:740:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_netweaver_and_abap_platform",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "740"
              },
              {
                "status": "affected",
                "version": "2008_1_710"
              },
              {
                "status": "affected",
                "version": "ST-PI_2008_1_700"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-33001",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-18T19:53:26.938876Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-30T17:29:13.906Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:27:53.403Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3453170"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver and ABAP platform",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "ST-PI 2008_1_700"
            },
            {
              "status": "affected",
              "version": "2008_1_710"
            },
            {
              "status": "affected",
              "version": "740"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSAP NetWeaver and ABAP platform allows an\nattacker to impede performance for legitimate users by crashing or flooding the\nservice.\u003c/p\u003e\n\nAn\nimpact of this Denial of Service vulnerability might be long response delays\nand service interruptions, thus degrading the service quality experienced by\nlegitimate users causing high impact on availability of the application.\n\n\n\n"
            }
          ],
          "value": "SAP NetWeaver and ABAP platform allows an\nattacker to impede performance for legitimate users by crashing or flooding the\nservice.\n\n\n\nAn\nimpact of this Denial of Service vulnerability might be long response delays\nand service interruptions, thus degrading the service quality experienced by\nlegitimate users causing high impact on availability of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-11T02:05:00.333Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3453170"
        },
        {
          "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Denial of service (DOS) in SAP NetWeaver and ABAP platform",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-33001",
    "datePublished": "2024-06-11T02:05:00.333Z",
    "dateReserved": "2024-04-23T04:04:25.520Z",
    "dateUpdated": "2024-08-02T02:27:53.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-37176

Vulnerability from cvelistv5

Published

2024-06-11 02:14

Modified

2024-08-02 03:50

Severity ?

5.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L

Summary

SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low impacts on the integrity and availability of the application.

References

▼	URL	Tags
	https://me.sap.com/notes/3465455
	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Impacted products

Vendor

Product

Version

▼

SAP_SE

SAP BW/4HANA Transformation and Data Transfer Process

Version: DW4CORE 200
Version: 300
Version: 400
Version: 796
Version: SAP_BW 740
Version: 750
Version: 751
Version: 752
Version: 753
Version: 754
Version: 755
Version: 756
Version: 757
Version: 758

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw_4hana:dw4core200:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw_4hana",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "dw4core200"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw_4hana:300:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw_4hana",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "300"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw_4hana:400:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw_4hana",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "400"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw_4hana:796:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw_4hana",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "796"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw_4hana:sap_bw_740:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw_4hana",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "sap_bw_740"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw:750:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "750"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw:751:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "751"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw:752:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "752"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw:753:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "753"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw:754:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "754"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw:755:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "755"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw:756:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "756"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw:757:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "757"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap_se:sap_bw:758:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sap_bw",
            "vendor": "sap_se",
            "versions": [
              {
                "status": "affected",
                "version": "758"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-37176",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-11T13:51:16.715875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-11T14:16:58.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:50:54.783Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3465455"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP BW/4HANA Transformation and Data Transfer Process",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "DW4CORE 200"
            },
            {
              "status": "affected",
              "version": "300"
            },
            {
              "status": "affected",
              "version": "400"
            },
            {
              "status": "affected",
              "version": "796"
            },
            {
              "status": "affected",
              "version": "SAP_BW 740"
            },
            {
              "status": "affected",
              "version": "750"
            },
            {
              "status": "affected",
              "version": "751"
            },
            {
              "status": "affected",
              "version": "752"
            },
            {
              "status": "affected",
              "version": "753"
            },
            {
              "status": "affected",
              "version": "754"
            },
            {
              "status": "affected",
              "version": "755"
            },
            {
              "status": "affected",
              "version": "756"
            },
            {
              "status": "affected",
              "version": "757"
            },
            {
              "status": "affected",
              "version": "758"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SAP BW/4HANA Transformation and Data Transfer\nProcess (DTP) allows an authenticated attacker to gain higher access levels\nthan they should have by exploiting improper authorization checks. This results\nin escalation of privileges. It has no impact on the confidentiality of data\nbut may have low impacts on the integrity and availability of the application.\n\n\n\n"
            }
          ],
          "value": "SAP BW/4HANA Transformation and Data Transfer\nProcess (DTP) allows an authenticated attacker to gain higher access levels\nthan they should have by exploiting improper authorization checks. This results\nin escalation of privileges. It has no impact on the confidentiality of data\nbut may have low impacts on the integrity and availability of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-11T02:14:45.656Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3465455"
        },
        {
          "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing Authorization check in SAP BW/4HANA Transformation and DTP",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-37176",
    "datePublished": "2024-06-11T02:14:45.656Z",
    "dateReserved": "2024-06-04T07:49:42.492Z",
    "dateUpdated": "2024-08-02T03:50:54.783Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_ncscnl

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature