Vulnerability-Lookup

CVE-2024-47590 (GCVE-0-2024-47590)

Vulnerability from cvelistv5 – Published: 2024-11-12 00:26 – Updated: 2024-11-12 17:11

Title

Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher

Summary

An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-12 16:07 UTC

CWE

CWE-791 - Incomplete Filtering of Special ElementCWE-918: Server-Side Request Forgery (SSRF)

Assigner

sap mitre root

References

2 references

URL	Tags
https://me.sap.com/notes/3520281
https://url.sap/sapsecuritypatchday

Impacted products

7 products

Vendor	Product	Version	CPE status
SAP_SE	SAP Web Dispatcher	Affected: WEBDISP 7.77 Affected: 7.89 Affected: 7.93 Affected: KERNEL 7.77 Affected: 9.12 Affected: 9.13	guessed
sap	web_dispatcher	Affected: 7.89 cpe:2.3:a:sap:web_dispatcher:7.89:::::::*
sap	web_dispatcher	Affected: 7.93 cpe:2.3:a:sap:web_dispatcher:7.93:::::::*
sap	web_dispatcher	Affected: kernel_7.77 cpe:2.3:a:sap:web_dispatcher:kernel_7.77:::::::*
sap	web_dispatcher	Affected: 9.12 cpe:2.3:a:sap:web_dispatcher:9.12:::::::*
sap	web_dispatcher	Affected: 9.13 cpe:2.3:a:sap:web_dispatcher:9.13:::::::*
sap	web_dispatcher	Affected: webdisp_7.77 cpe:2.3:a:sap:web_dispatcher:webdisp_7.77:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "web_dispatcher",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "7.89"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap:web_dispatcher:7.93:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "web_dispatcher",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "7.93"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap:web_dispatcher:kernel_7.77:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "web_dispatcher",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "kernel_7.77"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap:web_dispatcher:9.12:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "web_dispatcher",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "9.12"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap:web_dispatcher:9.13:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "web_dispatcher",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "9.13"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap:web_dispatcher:webdisp_7.77:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "web_dispatcher",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "webdisp_7.77"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47590",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-12T16:07:08.713669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T17:11:38.220Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Web Dispatcher",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "WEBDISP 7.77"
            },
            {
              "status": "affected",
              "version": "7.89"
            },
            {
              "status": "affected",
              "version": "7.93"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.77"
            },
            {
              "status": "affected",
              "version": "9.12"
            },
            {
              "status": "affected",
              "version": "9.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim\u0027s browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.\u003c/p\u003e"
            }
          ],
          "value": "An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim\u0027s browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-791",
              "description": "CWE-791: Incomplete Filtering of Special ElementCWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-12T00:27:03.370Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3520281"
        },
        {
          "url": "https://url.sap/sapsecuritypatchday"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-47590",
    "datePublished": "2024-11-12T00:26:18.659Z",
    "dateReserved": "2024-09-27T20:05:59.021Z",
    "dateUpdated": "2024-11-12T17:11:38.220Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47590",
      "date": "2026-09-20",
      "epss": "0.00764",
      "percentile": "0.5389"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "SAP Web Dispatcher",
                "vendor": "SAP_SE",
                "versions": [
                  {
                    "status": "affected",
                    "version": "WEBDISP 7.77"
                  },
                  {
                    "status": "affected",
                    "version": "7.89"
                  },
                  {
                    "status": "affected",
                    "version": "7.93"
                  },
                  {
                    "status": "affected",
                    "version": "KERNEL 7.77"
                  },
                  {
                    "status": "affected",
                    "version": "9.12"
                  },
                  {
                    "status": "affected",
                    "version": "9.13"
                  }
                ]
              }
            ],
            "source": "cna@sap.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "web_dispatcher",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.89"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:web_dispatcher:7.93:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "web_dispatcher",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.93"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:web_dispatcher:kernel_7.77:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "web_dispatcher",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "kernel_7.77"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:web_dispatcher:9.12:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "web_dispatcher",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "9.12"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:web_dispatcher:9.13:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "web_dispatcher",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "9.13"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:web_dispatcher:webdisp_7.77:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "web_dispatcher",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "webdisp_7.77"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim\u0027s browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability."
          },
          {
            "lang": "es",
            "value": "Un atacante no autenticado puede crear un enlace malicioso que puede poner a disposici\u00f3n del p\u00fablico. Cuando una v\u00edctima autenticada hace clic en este enlace malicioso, la generaci\u00f3n de p\u00e1ginas del sitio web utilizar\u00e1 los datos de entrada para crear contenido que, cuando se ejecute en el navegador de la v\u00edctima (XXS) o se transmita a otro servidor (SSRF), le dar\u00e1 al atacante la capacidad de ejecutar c\u00f3digo arbitrario en el servidor, comprometiendo por completo la confidencialidad, la integridad y la disponibilidad."
          }
        ],
        "id": "CVE-2024-47590",
        "lastModified": "2026-06-17T07:57:21.550",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "cna@sap.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-47590",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-12T16:07:08.713669Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-11-12T01:15:04.933",
        "references": [
          {
            "source": "cna@sap.com",
            "url": "https://me.sap.com/notes/3520281"
          },
          {
            "source": "cna@sap.com",
            "url": "https://url.sap/sapsecuritypatchday"
          }
        ],
        "sourceIdentifier": "cna@sap.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-791"
              }
            ],
            "source": "cna@sap.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T20:14:21+00:00",
      "cve": "CVE-2024-47590",
      "id": "CVE-2024-47590",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47590.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "web_dispatcher",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.89"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:web_dispatcher:7.93:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "web_dispatcher",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.93"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:web_dispatcher:kernel_7.77:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "web_dispatcher",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "kernel_7.77"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:web_dispatcher:9.12:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "web_dispatcher",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "9.12"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:web_dispatcher:9.13:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "web_dispatcher",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "9.13"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:web_dispatcher:webdisp_7.77:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "web_dispatcher",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "webdisp_7.77"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-47590",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-11-12T16:07:08.713669Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-11-12T17:11:04.424Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "SAP Web Dispatcher",
              "vendor": "SAP_SE",
              "versions": [
                {
                  "status": "affected",
                  "version": "WEBDISP 7.77"
                },
                {
                  "status": "affected",
                  "version": "7.89"
                },
                {
                  "status": "affected",
                  "version": "7.93"
                },
                {
                  "status": "affected",
                  "version": "KERNEL 7.77"
                },
                {
                  "status": "affected",
                  "version": "9.12"
                },
                {
                  "status": "affected",
                  "version": "9.13"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim\u0027s browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.\u003c/p\u003e"
                }
              ],
              "value": "An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim\u0027s browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-791",
                  "description": "CWE-791: Incomplete Filtering of Special ElementCWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "eng",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-11-12T00:27:03.370Z",
            "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
            "shortName": "sap"
          },
          "references": [
            {
              "url": "https://me.sap.com/notes/3520281"
            },
            {
              "url": "https://url.sap/sapsecuritypatchday"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "assignerShortName": "sap",
        "cveId": "CVE-2024-47590",
        "datePublished": "2024-11-12T00:26:18.659Z",
        "dateReserved": "2024-09-27T20:05:59.021Z",
        "dateUpdated": "2024-11-12T17:11:38.220Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2024-09703 (CVE-2024-47590)

Vulnerability from fstec – Published: 2024-11-17 – Updated: 2025-08-13 – View on bdu.fstec.ru Fixed

Title

Уязвимость веб-диспетчера SAP Web Dispatcher, связанная с неполной фильтрацией специальных элементов, позволяющая нарушителю проводить межсайтовые сценарные атаки

Summary

Уязвимость веб-диспетчера SAP Web Dispatcher связана с неполной фильтрацией специальных элементов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, проводить межсайтовые сценарные атаки

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

8.8 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Class

Architecture vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-791 - Неполное фильтрование специальных элементов

Aliases

CVE-2024-47590

References

2 references

URL
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/novemb…
https://me.sap.com/notes/3520281

Impacted products

1 product from 1 vendor

Vendors

SAP

Products

SAP Web Dispatcher

Versions

7.89 (SAP Web Dispatcher), 7.93 (SAP Web Dispatcher), kernel_7.77 (SAP Web Dispatcher), kernel_7.89 (SAP Web Dispatcher), WEBDISP 7.77 (SAP Web Dispatcher), WEBDISP 7.89 (SAP Web Dispatcher), WEBDISP 7.93 (SAP Web Dispatcher), 9.13 (SAP Web Dispatcher), 9.12 (SAP Web Dispatcher)

Product types

Network device, Network software

Mitigations

Использование рекомендаций: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2024.html

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "SAP",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7.89 (SAP Web Dispatcher), 7.93 (SAP Web Dispatcher), kernel_7.77 (SAP Web Dispatcher), kernel_7.89 (SAP Web Dispatcher), WEBDISP 7.77 (SAP Web Dispatcher), WEBDISP 7.89 (SAP Web Dispatcher), WEBDISP 7.93 (SAP Web Dispatcher), 9.13 (SAP Web Dispatcher), 9.12 (SAP Web Dispatcher)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2024.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "12.11.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "13.08.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "17.11.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-09703",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-47590",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "SAP Web Dispatcher",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u0435\u0431-\u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 SAP Web Dispatcher, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0439 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u043c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u044b\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u043e\u043b\u043d\u043e\u0435 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432 (CWE-791)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u0435\u0431-\u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 SAP Web Dispatcher \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0439 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u043c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u044b\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2024.html\nhttps://me.sap.com/notes/3520281",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-791",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,8)"
}

CERTFR-2024-AVI-0962

Vulnerability from certfr_avis - Published: 2024-11-12 - Updated: 2024-11-12

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
SAP	N/A	NetWeaver Application Server for ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.12 et 9.13 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Application Server Java (Logon Application) version SERVERCORE 7.5 sans le dernier correctif de sécurité
SAP	N/A	Host Agent version SAPHOSTAGENT 7.22 sans le dernier correctif de sécurité
SAP	N/A	Cash Management (Cash Operations) versions S4CORE 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Application Server ABAP versions KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93 et 9.12 sans le dernier correctif de sécurité
SAP	N/A	Web Dispatcher versions WEBDISP 7.77, 7.89, 7.93, KERNEL 7.77, 7.89, 7.93, 9.12 et 9.13 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver AS Java (System Landscape Directory) version LM-SLD 7.5 sans le dernier correctif de sécurité

References

Title

Publication Time

CERTFR-2024-AVI-1054

Vulnerability from certfr_avis - Published: 2024-12-10 - Updated: 2024-12-10

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
SAP	N/A	NetWeaver Administrator (System Overview) version LM-CORE 7.50 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Application Server ABAP versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89 et 7.93 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Application Server for ABAP and ABAP Platform versions SAP_BASIS 740, SAP_BASIS 750, KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.12 et 9.13 sans le dernier correctif de sécurité
SAP	N/A	HCM version S4HCMGXX 101 sans le dernier correctif de sécurité
SAP	N/A	Commerce Cloud versions HY_COM 2205 et COM_CLOUD 2211 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver AS for JAVA (Adobe Document Services) version ADSSSAP 7.50 sans le dernier correctif de sécurité
SAP	N/A	Web Dispatcher versions WEBDISP 7.77, 7.89, 7.93, KERNEL 7.77, 7.89, 7.93, 9.12 et 9.13 sans le dernier correctif de sécurité
SAP	N/A	BusinessObjects Business Intelligence Platform versions ENTERPRISE 430 et 2025 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver AS JAVA version LM-CORE 7.50 sans le dernier correctif de sécurité
SAP	N/A	Product Lifecycle Costing version PLC_CLIENT 4 sans le dernier correctif de sécurité

References

Title

Publication Time

FKIE_CVE-2024-47590

Vulnerability from fkie_nvd - Published: 2024-11-12 01:15 - Updated: 2026-06-17 07:57

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	cna@sap.com	https://me.sap.com/notes/3520281
	cna@sap.com	https://url.sap/sapsecuritypatchday

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Web Dispatcher",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "WEBDISP 7.77"
            },
            {
              "status": "affected",
              "version": "7.89"
            },
            {
              "status": "affected",
              "version": "7.93"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.77"
            },
            {
              "status": "affected",
              "version": "9.12"
            },
            {
              "status": "affected",
              "version": "9.13"
            }
          ]
        }
      ],
      "source": "cna@sap.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "web_dispatcher",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "7.89"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:web_dispatcher:7.93:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "web_dispatcher",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "7.93"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:web_dispatcher:kernel_7.77:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "web_dispatcher",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "kernel_7.77"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:web_dispatcher:9.12:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "web_dispatcher",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "9.12"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:web_dispatcher:9.13:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "web_dispatcher",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "9.13"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:web_dispatcher:webdisp_7.77:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "web_dispatcher",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "webdisp_7.77"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim\u0027s browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability."
    },
    {
      "lang": "es",
      "value": "Un atacante no autenticado puede crear un enlace malicioso que puede poner a disposici\u00f3n del p\u00fablico. Cuando una v\u00edctima autenticada hace clic en este enlace malicioso, la generaci\u00f3n de p\u00e1ginas del sitio web utilizar\u00e1 los datos de entrada para crear contenido que, cuando se ejecute en el navegador de la v\u00edctima (XXS) o se transmita a otro servidor (SSRF), le dar\u00e1 al atacante la capacidad de ejecutar c\u00f3digo arbitrario en el servidor, comprometiendo por completo la confidencialidad, la integridad y la disponibilidad."
    }
  ],
  "id": "CVE-2024-47590",
  "lastModified": "2026-06-17T07:57:21.550",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "cna@sap.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47590",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-11-12T16:07:08.713669Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-11-12T01:15:04.933",
  "references": [
    {
      "source": "cna@sap.com",
      "url": "https://me.sap.com/notes/3520281"
    },
    {
      "source": "cna@sap.com",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-791"
        }
      ],
      "source": "cna@sap.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5PJ7-9H42-MFX3

Vulnerability from github – Published: 2024-11-12 03:30 – Updated: 2024-11-12 03:30

Details

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-47590"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-791"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-12T01:15:04Z",
    "severity": "HIGH"
  },
  "details": "An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim\u0027s browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.",
  "id": "GHSA-5pj7-9h42-mfx3",
  "modified": "2024-11-12T03:30:48Z",
  "published": "2024-11-12T03:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47590"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3520281"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2024-0472

Vulnerability from csaf_ncscnl - Published: 2024-12-10 19:34 - Updated: 2024-12-10 19:34

Summary

Kwetsbaarheden verholpen in SAP producten

Scope

13 vulnerabilities in this advisory, including CVE-2024-47590.

CVE-2024-47590

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Known affected: 8 products

Open the full advisory

WID-SEC-W-2024-3407

Vulnerability from csaf_certbund - Published: 2024-11-11 23:00 - Updated: 2024-11-11 23:00

Summary

SAP Patchday November 2024: Mehrere Schwachstellen

Severity

Hoch

Scope

10 vulnerabilities in this advisory, including CVE-2024-47590.

CVE-2024-47590

Es bestehen mehrere Schwachstellen in SAP-Software. Diese Schwachstellen bestehen in mehreren Komponenten, darunter der Host Agent, der Web Dispatcher und der NetWeaver Application Server, u.a. aufgrund verschiedener sicherheitsrelevanter Probleme, wie z.B. einer fehlenden Autorisierung oder einer Null-Pointer-Dereferenz-Schwachstelle. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuführen und beliebigen Code auszuführen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt werden zu könne

Known affected: 1 product

Open the full advisory

WID-SEC-W-2024-3640

Vulnerability from csaf_certbund - Published: 2024-12-09 23:00 - Updated: 2024-12-09 23:00

Summary

SAP Patchday Dezember 2024: Mehrere Schwachstellen

Severity

Hoch

Scope

14 vulnerabilities in this advisory, including CVE-2024-47590.

CVE-2024-47590

In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten wie NetWeaver, BusinessObjects Business Intelligence oder Commerce Cloud, unter anderem wegen mehrerer sicherheitsrelevanter Probleme wie einer NULL-Zeiger-Dereferenz, einer fehlenden Berechtigungsprüfung oder einer unsachgemäßen Eingabevalidierung. Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten zu verändern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzerinteraktion erforderlich.

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-47590 (GCVE-0-2024-47590)

BDU:2024-09703 (CVE-2024-47590)

CERTFR-2024-AVI-0962

Solutions

CERTFR-2024-AVI-1054

Solutions

FKIE_CVE-2024-47590

GHSA-5PJ7-9H42-MFX3

NCSC-2024-0472

WID-SEC-W-2024-3407

WID-SEC-W-2024-3640

Tags

Sightings

Nomenclature

Related by attack behaviour