Vulnerability-Lookup

CVE-2024-47586 (GCVE-0-2024-47586)

Vulnerability from cvelistv5 – Published: 2024-11-12 00:25 – Updated: 2024-11-12 17:14

Title

NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

Summary

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-12 16:07 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

sap mitre root

References

2 references

URL	Tags
https://me.sap.com/notes/3504390
https://url.sap/sapsecuritypatchday

Impacted products

2 products

Vendor	Product	Version	CPE status
SAP_SE	SAP NetWeaver Application Server for ABAP and ABAP Platform	Affected: KRNL64NUC 7.22 Affected: 7.22EXT Affected: KRNL64UC 7.22 Affected: 7.53 Affected: 8.04 Affected: KERNEL 7.22 Affected: 7.54 Affected: 7.77 Affected: 7.89 Affected: 7.93 Affected: 9.12 Affected: 9.13	guessed
sap	netweaver_abap_application_server	Affected: KRNL64NUC 7.22 Affected: 7.22EXT Affected: KRNL64UC 7.22 Affected: 7.53 Affected: 8.04 Affected: KERNEL 7.22 Affected: 7.54 Affected: 7.77 Affected: 7.89 Affected: 7.93 Affected: 9.12 Affected: 9.13 cpe:2.3:a:sap:netweaver_abap_application_server::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sap:netweaver_abap_application_server:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netweaver_abap_application_server",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "KRNL64NUC 7.22"
              },
              {
                "status": "affected",
                "version": "7.22EXT"
              },
              {
                "status": "affected",
                "version": "KRNL64UC 7.22"
              },
              {
                "status": "affected",
                "version": "7.53"
              },
              {
                "status": "affected",
                "version": "8.04"
              },
              {
                "status": "affected",
                "version": "KERNEL 7.22"
              },
              {
                "status": "affected",
                "version": "7.54"
              },
              {
                "status": "affected",
                "version": "7.77"
              },
              {
                "status": "affected",
                "version": "7.89"
              },
              {
                "status": "affected",
                "version": "7.93"
              },
              {
                "status": "affected",
                "version": "9.12"
              },
              {
                "status": "affected",
                "version": "9.13"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-12T16:07:46.695432Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T17:14:50.589Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver Application Server for ABAP and ABAP Platform",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22"
            },
            {
              "status": "affected",
              "version": "7.22EXT"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.22"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "8.04"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.22"
            },
            {
              "status": "affected",
              "version": "7.54"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.89"
            },
            {
              "status": "affected",
              "version": "7.93"
            },
            {
              "status": "affected",
              "version": "9.12"
            },
            {
              "status": "affected",
              "version": "9.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity.\u003c/p\u003e"
            }
          ],
          "value": "SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-12T00:25:56.315Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3504390"
        },
        {
          "url": "https://url.sap/sapsecuritypatchday"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-47586",
    "datePublished": "2024-11-12T00:25:56.315Z",
    "dateReserved": "2024-09-27T20:05:59.021Z",
    "dateUpdated": "2024-11-12T17:14:50.589Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47586",
      "date": "2026-09-20",
      "epss": "0.0354",
      "percentile": "0.88749"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "SAP NetWeaver Application Server for ABAP and ABAP Platform",
                "vendor": "SAP_SE",
                "versions": [
                  {
                    "status": "affected",
                    "version": "KRNL64NUC 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.22EXT"
                  },
                  {
                    "status": "affected",
                    "version": "KRNL64UC 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.53"
                  },
                  {
                    "status": "affected",
                    "version": "8.04"
                  },
                  {
                    "status": "affected",
                    "version": "KERNEL 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.54"
                  },
                  {
                    "status": "affected",
                    "version": "7.77"
                  },
                  {
                    "status": "affected",
                    "version": "7.89"
                  },
                  {
                    "status": "affected",
                    "version": "7.93"
                  },
                  {
                    "status": "affected",
                    "version": "9.12"
                  },
                  {
                    "status": "affected",
                    "version": "9.13"
                  }
                ]
              }
            ],
            "source": "cna@sap.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:sap:netweaver_abap_application_server:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netweaver_abap_application_server",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "KRNL64NUC 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.22EXT"
                  },
                  {
                    "status": "affected",
                    "version": "KRNL64UC 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.53"
                  },
                  {
                    "status": "affected",
                    "version": "8.04"
                  },
                  {
                    "status": "affected",
                    "version": "KERNEL 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.54"
                  },
                  {
                    "status": "affected",
                    "version": "7.77"
                  },
                  {
                    "status": "affected",
                    "version": "7.89"
                  },
                  {
                    "status": "affected",
                    "version": "7.93"
                  },
                  {
                    "status": "affected",
                    "version": "9.12"
                  },
                  {
                    "status": "affected",
                    "version": "9.13"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity."
          },
          {
            "lang": "es",
            "value": "SAP NetWeaver Application Server para ABAP y la plataforma ABAP permite que un atacante no autenticado env\u00ede una solicitud http manipulada con fines malintencionados que podr\u00eda provocar una desreferencia de puntero nulo en el n\u00facleo. Esta desreferencia provocar\u00e1 que el sistema se bloquee y se reinicie, lo que provocar\u00e1 que el sistema no est\u00e9 disponible temporalmente. No hay ning\u00fan impacto en la confidencialidad ni en la integridad."
          }
        ],
        "id": "CVE-2024-47586",
        "lastModified": "2026-06-17T07:57:21.237",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "cna@sap.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-47586",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-12T16:07:46.695432Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-11-12T01:15:04.190",
        "references": [
          {
            "source": "cna@sap.com",
            "url": "https://me.sap.com/notes/3504390"
          },
          {
            "source": "cna@sap.com",
            "url": "https://url.sap/sapsecuritypatchday"
          }
        ],
        "sourceIdentifier": "cna@sap.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "cna@sap.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T19:25:07+00:00",
      "cve": "CVE-2024-47586",
      "id": "CVE-2024-47586",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47586.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:sap:netweaver_abap_application_server:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netweaver_abap_application_server",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "KRNL64NUC 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.22EXT"
                  },
                  {
                    "status": "affected",
                    "version": "KRNL64UC 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.53"
                  },
                  {
                    "status": "affected",
                    "version": "8.04"
                  },
                  {
                    "status": "affected",
                    "version": "KERNEL 7.22"
                  },
                  {
                    "status": "affected",
                    "version": "7.54"
                  },
                  {
                    "status": "affected",
                    "version": "7.77"
                  },
                  {
                    "status": "affected",
                    "version": "7.89"
                  },
                  {
                    "status": "affected",
                    "version": "7.93"
                  },
                  {
                    "status": "affected",
                    "version": "9.12"
                  },
                  {
                    "status": "affected",
                    "version": "9.13"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-47586",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-11-12T16:07:46.695432Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-11-12T17:14:35.347Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "SAP NetWeaver Application Server for ABAP and ABAP Platform",
              "vendor": "SAP_SE",
              "versions": [
                {
                  "status": "affected",
                  "version": "KRNL64NUC 7.22"
                },
                {
                  "status": "affected",
                  "version": "7.22EXT"
                },
                {
                  "status": "affected",
                  "version": "KRNL64UC 7.22"
                },
                {
                  "status": "affected",
                  "version": "7.53"
                },
                {
                  "status": "affected",
                  "version": "8.04"
                },
                {
                  "status": "affected",
                  "version": "KERNEL 7.22"
                },
                {
                  "status": "affected",
                  "version": "7.54"
                },
                {
                  "status": "affected",
                  "version": "7.77"
                },
                {
                  "status": "affected",
                  "version": "7.89"
                },
                {
                  "status": "affected",
                  "version": "7.93"
                },
                {
                  "status": "affected",
                  "version": "9.12"
                },
                {
                  "status": "affected",
                  "version": "9.13"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eSAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity.\u003c/p\u003e"
                }
              ],
              "value": "SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-476",
                  "description": "CWE-476: NULL Pointer Dereference",
                  "lang": "eng",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-11-12T00:25:56.315Z",
            "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
            "shortName": "sap"
          },
          "references": [
            {
              "url": "https://me.sap.com/notes/3504390"
            },
            {
              "url": "https://url.sap/sapsecuritypatchday"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "assignerShortName": "sap",
        "cveId": "CVE-2024-47586",
        "datePublished": "2024-11-12T00:25:56.315Z",
        "dateReserved": "2024-09-27T20:05:59.021Z",
        "dateUpdated": "2024-11-12T17:14:50.589Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2024-10527 (CVE-2024-47586)

Vulnerability from fstec – Published: 2024-12-02 – Updated: 2024-12-02 – View on bdu.fstec.ru Fixed

Title

Уязвимость программной интеграционной платформы SAP NetWeaver AS ABAP и SAP ABAP Platform, связанная с разыменованием нулевого указателя, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость программной интеграционной платформы SAP NetWeaver AS ABAP и SAP ABAP Platform связана с разыменованием нулевого указателя. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Severity

5.0 (Medium) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:N/A:P

5.3 (Medium) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-476 - Разыменование указателя NULL

Aliases

CVE-2024-47586

References

3 references

URL
https://www.cve.org/CVERecord?id=CVE-2024-47586
https://vulners.com/cve/CVE-2024-47586
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/novemb…

Impacted products

2 products from 1 vendor

Vendors

SAP

Products

SAP ABAP Platform, SAP NetWeaver As ABAP

Versions

KRNL64UC 7.22 (SAP ABAP Platform), 7.22 (SAP NetWeaver As ABAP), 7.53 (SAP NetWeaver As ABAP), 7.77 (SAP NetWeaver As ABAP), 8.04 (SAP NetWeaver As ABAP), krnl64uc 7.22 (SAP NetWeaver As ABAP), kernel 7.22 (SAP NetWeaver As ABAP), KERNEL 7.22 (SAP ABAP Platform), 7.22EXT (SAP NetWeaver As ABAP), 7.89 (SAP NetWeaver As ABAP), 7.54 (SAP NetWeaver As ABAP), 7.93 (SAP NetWeaver As ABAP), 7.22 (SAP ABAP Platform), 7.22EXT (SAP ABAP Platform), 7.53 (SAP ABAP Platform), 8.04 (SAP ABAP Platform), 7.54 (SAP ABAP Platform), 7.77 (SAP ABAP Platform), 7.89 (SAP ABAP Platform), 7.93 (SAP ABAP Platform), 9.12 (SAP ABAP Platform), 9.13 (SAP ABAP Platform), 9.12 (SAP NetWeaver As ABAP), 9.13 (SAP NetWeaver As ABAP)

Product types

Application software

Mitigations

Использование рекомендаций: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2024.html

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "SAP",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "KRNL64UC 7.22 (SAP ABAP Platform), 7.22 (SAP NetWeaver As ABAP), 7.53 (SAP NetWeaver As ABAP), 7.77 (SAP NetWeaver As ABAP), 8.04 (SAP NetWeaver As ABAP), krnl64uc 7.22 (SAP NetWeaver As ABAP), kernel 7.22 (SAP NetWeaver As ABAP), KERNEL 7.22 (SAP ABAP Platform), 7.22EXT (SAP NetWeaver As ABAP), 7.89 (SAP NetWeaver As ABAP), 7.54 (SAP NetWeaver As ABAP), 7.93 (SAP NetWeaver As ABAP), 7.22 (SAP ABAP Platform), 7.22EXT (SAP ABAP Platform), 7.53 (SAP ABAP Platform), 8.04 (SAP ABAP Platform), 7.54 (SAP ABAP Platform), 7.77 (SAP ABAP Platform), 7.89 (SAP ABAP Platform), 7.93 (SAP ABAP Platform), 9.12 (SAP ABAP Platform), 9.13 (SAP ABAP Platform), 9.12 (SAP NetWeaver As ABAP), 9.13 (SAP NetWeaver As ABAP)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2024.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "12.11.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "02.12.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "02.12.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-10527",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-47586",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "SAP ABAP Platform, SAP NetWeaver As ABAP",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b SAP NetWeaver AS ABAP \u0438 SAP ABAP Platform, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0440\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f NULL (CWE-476)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b SAP NetWeaver AS ABAP \u0438 SAP ABAP Platform \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0440\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.cve.org/CVERecord?id=CVE-2024-47586\nhttps://vulners.com/cve/CVE-2024-47586\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2024.html",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-476",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,3)"
}

CERTFR-2024-AVI-0962

Vulnerability from certfr_avis - Published: 2024-11-12 - Updated: 2024-11-12

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
SAP	N/A	NetWeaver Application Server for ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.12 et 9.13 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Application Server Java (Logon Application) version SERVERCORE 7.5 sans le dernier correctif de sécurité
SAP	N/A	Host Agent version SAPHOSTAGENT 7.22 sans le dernier correctif de sécurité
SAP	N/A	Cash Management (Cash Operations) versions S4CORE 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Application Server ABAP versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93 et 9.12 sans le dernier correctif de sécurité
SAP	N/A	Web Dispatcher versions WEBDISP 7.77, 7.89, 7.93, KERNEL 7.77, 7.89, 7.93, 9.12 et 9.13 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver AS Java (System Landscape Directory) version LM-SLD 7.5 sans le dernier correctif de sécurité

References

Title

Publication Time

CERTFR-2024-AVI-1054

Vulnerability from certfr_avis - Published: 2024-12-10 - Updated: 2024-12-10

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
SAP	N/A	NetWeaver Administrator (System Overview) version LM-CORE 7.50 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Application Server ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89 et 7.93 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.12 et 9.13 sans le dernier correctif de sécurité
SAP	N/A	HCM version S4HCMGXX 101 sans le dernier correctif de sécurité
SAP	N/A	Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver AS for JAVA (Adobe Document Services) version ADSSSAP 7.50 sans le dernier correctif de sécurité
SAP	N/A	Web Dispatcher versions WEBDISP 7.77, 7.89, 7.93, KERNEL 7.77, 7.89, 7.93, 9.12 et 9.13 sans le dernier correctif de sécurité
SAP	N/A	BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 2025 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver AS JAVA version LM-CORE 7.50 sans le dernier correctif de sécurité
SAP	N/A	Product Lifecycle Costing version PLC_CLIENT 4 sans le dernier correctif de sécurité

References

Title

Publication Time

FKIE_CVE-2024-47586

Vulnerability from fkie_nvd - Published: 2024-11-12 01:15 - Updated: 2026-06-17 07:57

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	cna@sap.com	https://me.sap.com/notes/3504390
	cna@sap.com	https://url.sap/sapsecuritypatchday

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver Application Server for ABAP and ABAP Platform",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22"
            },
            {
              "status": "affected",
              "version": "7.22EXT"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.22"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "8.04"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.22"
            },
            {
              "status": "affected",
              "version": "7.54"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.89"
            },
            {
              "status": "affected",
              "version": "7.93"
            },
            {
              "status": "affected",
              "version": "9.12"
            },
            {
              "status": "affected",
              "version": "9.13"
            }
          ]
        }
      ],
      "source": "cna@sap.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:sap:netweaver_abap_application_server:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "netweaver_abap_application_server",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22"
            },
            {
              "status": "affected",
              "version": "7.22EXT"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.22"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "8.04"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.22"
            },
            {
              "status": "affected",
              "version": "7.54"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.89"
            },
            {
              "status": "affected",
              "version": "7.93"
            },
            {
              "status": "affected",
              "version": "9.12"
            },
            {
              "status": "affected",
              "version": "9.13"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity."
    },
    {
      "lang": "es",
      "value": "SAP NetWeaver Application Server para ABAP y la plataforma ABAP permite que un atacante no autenticado env\u00ede una solicitud http manipulada con fines malintencionados que podr\u00eda provocar una desreferencia de puntero nulo en el n\u00facleo. Esta desreferencia provocar\u00e1 que el sistema se bloquee y se reinicie, lo que provocar\u00e1 que el sistema no est\u00e9 disponible temporalmente. No hay ning\u00fan impacto en la confidencialidad ni en la integridad."
    }
  ],
  "id": "CVE-2024-47586",
  "lastModified": "2026-06-17T07:57:21.237",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "cna@sap.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47586",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-11-12T16:07:46.695432Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-11-12T01:15:04.190",
  "references": [
    {
      "source": "cna@sap.com",
      "url": "https://me.sap.com/notes/3504390"
    },
    {
      "source": "cna@sap.com",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "cna@sap.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FGFV-4H4Q-WRVX

Vulnerability from github – Published: 2024-11-12 03:30 – Updated: 2024-11-12 03:30

Details

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-47586"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-12T01:15:04Z",
    "severity": "MODERATE"
  },
  "details": "SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity.",
  "id": "GHSA-fgfv-4h4q-wrvx",
  "modified": "2024-11-12T03:30:47Z",
  "published": "2024-11-12T03:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47586"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3504390"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2024-0472

Vulnerability from csaf_ncscnl - Published: 2024-12-10 19:34 - Updated: 2024-12-10 19:34

Summary

Kwetsbaarheden verholpen in SAP producten

Scope

13 vulnerabilities in this advisory, including CVE-2024-47586.

CVE-2024-47586

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Known affected: 10 products

Open the full advisory

WID-SEC-W-2024-3407

Vulnerability from csaf_certbund - Published: 2024-11-11 23:00 - Updated: 2024-11-11 23:00

Summary

SAP Patchday November 2024: Mehrere Schwachstellen

Severity

Hoch

Scope

10 vulnerabilities in this advisory, including CVE-2024-47586.

CVE-2024-47586

Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuführen und beliebigen Code auszuführen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu könne

Known affected: 1 product

Open the full advisory

WID-SEC-W-2024-3640

Vulnerability from csaf_certbund - Published: 2024-12-09 23:00 - Updated: 2024-12-09 23:00

Summary

SAP Patchday Dezember 2024: Mehrere Schwachstellen

Severity

Hoch

Scope

14 vulnerabilities in this advisory, including CVE-2024-47586.

CVE-2024-47586

In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungsprüfung oder einer unsachgemäßen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten zu verändern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich.

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-47586 (GCVE-0-2024-47586)

BDU:2024-10527 (CVE-2024-47586)

CERTFR-2024-AVI-0962

Solutions

CERTFR-2024-AVI-1054

Solutions

FKIE_CVE-2024-47586

GHSA-FGFV-4H4Q-WRVX

NCSC-2024-0472

WID-SEC-W-2024-3407

WID-SEC-W-2024-3640

Tags

Sightings

Nomenclature

Related by attack behaviour