Vulnerability-Lookup

CVE-2024-27901 (GCVE-0-2024-27901)

Vulnerability from cvelistv5 – Published: 2024-04-09 00:55 – Updated: 2024-09-06 18:01

Title

Directory Traversal vulnerability in SAP Asset Accounting

Summary

SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-07 16:26 UTC

CWE

CWE-35 - Path Traversal

Assigner

sap CNA under the mitre root

CNA scorecard C 65/100 over 117 records in the last 180 days details

References

2 references

URL	Tags
https://me.sap.com/notes/3438234
https://support.sap.com/en/my-support/knowledge-b…

Impacted products

2 products

Vendor	Product	Version	CPE status
SAP_SE	SAP Asset Accounting	Affected: SAP_APPL 600 Affected: SAP_APPL 602 Affected: SAP_APPL 603 Affected: SAP_APPL 604 Affected: SAP_APPL 605 Affected: SAP_APPL 606 Affected: SAP_FIN617 Affected: SAP_FIN 618 Affected: SAP_FIN700	guessed
sap	asset_accounting	Affected: sap_appl600 Affected: sap_appl602 Affected: sap_appl603 Affected: sap_appl604 Affected: sap_appl605 Affected: sap_appl606 Affected: sap_fin617 Affected: sap_fin618 Affected: sap_fin700 cpe:2.3:a:sap:asset_accounting::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:55.774Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3438234"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sap:asset_accounting:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "asset_accounting",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "sap_appl600"
              },
              {
                "status": "affected",
                "version": "sap_appl602"
              },
              {
                "status": "affected",
                "version": "sap_appl603"
              },
              {
                "status": "affected",
                "version": "sap_appl604"
              },
              {
                "status": "affected",
                "version": "sap_appl605"
              },
              {
                "status": "affected",
                "version": "sap_appl606"
              },
              {
                "status": "affected",
                "version": "sap_fin617"
              },
              {
                "status": "affected",
                "version": "sap_fin618"
              },
              {
                "status": "affected",
                "version": "sap_fin700"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27901",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-07T16:26:56.367266Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-06T18:01:25.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Asset Accounting",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_APPL 600"
            },
            {
              "status": "affected",
              "version": "SAP_APPL 602"
            },
            {
              "status": "affected",
              "version": "SAP_APPL 603"
            },
            {
              "status": "affected",
              "version": "SAP_APPL 604"
            },
            {
              "status": "affected",
              "version": "SAP_APPL 605"
            },
            {
              "status": "affected",
              "version": "SAP_APPL 606"
            },
            {
              "status": "affected",
              "version": "SAP_FIN617"
            },
            {
              "status": "affected",
              "version": "SAP_FIN 618"
            },
            {
              "status": "affected",
              "version": "SAP_FIN700"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API\u0027s. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\u003c/p\u003e"
            }
          ],
          "value": "SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API\u0027s. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-35",
              "description": "CWE-35: Path Traversal",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-09T00:55:03.642Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3438234"
        },
        {
          "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Directory Traversal vulnerability in SAP Asset Accounting",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-27901",
    "datePublished": "2024-04-09T00:55:03.642Z",
    "dateReserved": "2024-02-27T06:26:16.787Z",
    "dateUpdated": "2024-09-06T18:01:25.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27901",
      "date": "2026-10-31",
      "epss": "0.00726",
      "percentile": "0.54128"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "SAP Asset Accounting",
                "vendor": "SAP_SE",
                "versions": [
                  {
                    "status": "affected",
                    "version": "SAP_APPL 600"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_APPL 602"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_APPL 603"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_APPL 604"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_APPL 605"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_APPL 606"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_FIN617"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_FIN 618"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_FIN700"
                  }
                ]
              }
            ],
            "source": "cna@sap.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:sap:asset_accounting:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "asset_accounting",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "sap_appl600"
                  },
                  {
                    "status": "affected",
                    "version": "sap_appl602"
                  },
                  {
                    "status": "affected",
                    "version": "sap_appl603"
                  },
                  {
                    "status": "affected",
                    "version": "sap_appl604"
                  },
                  {
                    "status": "affected",
                    "version": "sap_appl605"
                  },
                  {
                    "status": "affected",
                    "version": "sap_appl606"
                  },
                  {
                    "status": "affected",
                    "version": "sap_fin617"
                  },
                  {
                    "status": "affected",
                    "version": "sap_fin618"
                  },
                  {
                    "status": "affected",
                    "version": "sap_fin700"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API\u0027s. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\n\n"
          },
          {
            "lang": "es",
            "value": "SAP Asset Accounting podr\u00eda permitir que un atacante con altos privilegios aproveche la validaci\u00f3n insuficiente de la informaci\u00f3n de ruta proporcionada por los usuarios y la pase a las API de archivos. Provocando as\u00ed un impacto considerable en la confidencialidad, integridad y disponibilidad de la aplicaci\u00f3n."
          }
        ],
        "id": "CVE-2024-27901",
        "lastModified": "2026-06-17T07:20:33.997",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 5.9,
              "source": "cna@sap.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-27901",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-07T16:26:56.367266Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-09T01:15:48.993",
        "references": [
          {
            "source": "cna@sap.com",
            "url": "https://me.sap.com/notes/3438234"
          },
          {
            "source": "cna@sap.com",
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://me.sap.com/notes/3438234"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
          }
        ],
        "sourceIdentifier": "cna@sap.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-35"
              }
            ],
            "source": "cna@sap.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T21:14:40+00:00",
      "cve": "CVE-2024-27901",
      "id": "CVE-2024-27901",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Directory Traversal vulnerability in SAP Asset Accounting",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27901.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:41:55.774Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://me.sap.com/notes/3438234"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:sap:asset_accounting:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "asset_accounting",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "sap_appl600"
                  },
                  {
                    "status": "affected",
                    "version": "sap_appl602"
                  },
                  {
                    "status": "affected",
                    "version": "sap_appl603"
                  },
                  {
                    "status": "affected",
                    "version": "sap_appl604"
                  },
                  {
                    "status": "affected",
                    "version": "sap_appl605"
                  },
                  {
                    "status": "affected",
                    "version": "sap_appl606"
                  },
                  {
                    "status": "affected",
                    "version": "sap_fin617"
                  },
                  {
                    "status": "affected",
                    "version": "sap_fin618"
                  },
                  {
                    "status": "affected",
                    "version": "sap_fin700"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-27901",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-08-07T16:26:56.367266Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-08-29T14:12:32.132Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "SAP Asset Accounting",
              "vendor": "SAP_SE",
              "versions": [
                {
                  "status": "affected",
                  "version": "SAP_APPL 600"
                },
                {
                  "status": "affected",
                  "version": "SAP_APPL 602"
                },
                {
                  "status": "affected",
                  "version": "SAP_APPL 603"
                },
                {
                  "status": "affected",
                  "version": "SAP_APPL 604"
                },
                {
                  "status": "affected",
                  "version": "SAP_APPL 605"
                },
                {
                  "status": "affected",
                  "version": "SAP_APPL 606"
                },
                {
                  "status": "affected",
                  "version": "SAP_FIN617"
                },
                {
                  "status": "affected",
                  "version": "SAP_FIN 618"
                },
                {
                  "status": "affected",
                  "version": "SAP_FIN700"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eSAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API\u0027s. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\u003c/p\u003e"
                }
              ],
              "value": "SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API\u0027s. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\n\n"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-35",
                  "description": "CWE-35: Path Traversal",
                  "lang": "eng",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-04-09T00:55:03.642Z",
            "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
            "shortName": "sap"
          },
          "references": [
            {
              "url": "https://me.sap.com/notes/3438234"
            },
            {
              "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Directory Traversal vulnerability in SAP Asset Accounting",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "assignerShortName": "sap",
        "cveId": "CVE-2024-27901",
        "datePublished": "2024-04-09T00:55:03.642Z",
        "dateReserved": "2024-02-27T06:26:16.787Z",
        "dateUpdated": "2024-09-06T18:01:25.580Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2024-03124 (CVE-2024-27901)

Vulnerability from fstec – Published: 2024-04-22 – Updated: 2024-04-22 – View on bdu.fstec.ru Fixed

Title

Уязвимость программного обеспечения для управления и учета основных средств предприятия SAP Asset Accounting, связанная с неверным ограничением имени пути к каталогу, позволяющая нарушителю оказать влияние на конфиденциальность, целостность и доступность защищаемой информации

Summary

Уязвимость программного обеспечения для управления и учета основных средств предприятия SAP Asset Accounting связана с неверным ограничением имени пути к каталогу. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать влияние на конфиденциальность, целостность и доступность защищаемой информации с помощью специально сформированной html-страницы

Severity

8.3 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:M/C:C/I:C/A:C

7.2 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Functionality abuse

Incidents

Being clarified

Remediation

Software update

CWE

CWE-35 - Обход пути: ‘…/…//’

Aliases

CVE-2024-27901

References

3 references

URL
https://me.sap.com/notes/3438234
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?a…
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-…

Impacted products

1 product from 1 vendor

Vendors

SAP

Products

SAP Asset Accounting

Versions

SAP_APPL 600 (SAP Asset Accounting), SAP_FIN617 (SAP Asset Accounting), SAP_FIN 618 (SAP Asset Accounting), SAP_FIN700 (SAP Asset Accounting)

Product types

Application software

Mitigations

Использование рекомендаций: https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2024.html

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:M/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "SAP",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "SAP_APPL 600 (SAP Asset Accounting), SAP_FIN617 (SAP Asset Accounting), SAP_FIN 618 (SAP Asset Accounting), SAP_FIN700 (SAP Asset Accounting)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2024.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "09.04.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "22.04.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "22.04.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-03124",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-27901",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "SAP Asset Accounting",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0443\u0447\u0435\u0442\u0430 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f SAP Asset Accounting, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u0438\u043c\u0435\u043d\u0438 \u043f\u0443\u0442\u0438 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043b\u0438\u044f\u043d\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438: \u2018\u2026/\u2026//\u2019 (CWE-35)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0443\u0447\u0435\u0442\u0430 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f SAP Asset Accounting  \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u0438\u043c\u0435\u043d\u0438 \u043f\u0443\u0442\u0438 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043b\u0438\u044f\u043d\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 html-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0417\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u043e\u043c",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://me.sap.com/notes/3438234\t\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2024.html",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-35",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,3)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,2)"
}

CERTFR-2024-AVI-0283

Vulnerability from certfr_avis - Published: 2024-04-09 - Updated: 2024-04-12

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
SAP	N/A	Business Connector version 4.8 sans le dernier correctif de sécurité
SAP	N/A	S/4 HANA (Manage Catalog Items and Cross-Catalog search) versions S4CORE 103, S4CORE 104, S4CORE 105 et S4CORE 106 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver version 7.50 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver AS ABAP and ABAP Platform versions KRNL64NUC 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54 et KERNEL 7.93 sans le dernier correctif de sécurité
SAP	N/A	S/4 HANA (Cash Management) versions S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107 et S4CORE 108 sans le dernier correctif de sécurité
SAP	N/A	Employee Self Service (Fiori My Leave Request) version 605 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver AS Java User Management Engine versions SERVERCORE 7.50, J2EE-APPS 7.50 et UMEADMIN 7.50 sans le dernier correctif de sécurité
SAP	N/A	Group Reporting Data Collection (Enter Package Data) versions S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108 et SAP_GRDC_CLOUD 1.0.0 sans le dernier correctif de sécurité
SAP	N/A	BusinessObjects Web Intelligence versions 4.2 et 4.3 sans le dernier correctif de sécurité
SAP	N/A	Edge Integration Cell versions antérieures à 8.13.5
SAP	N/A	Asset Accounting versions SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_FIN617, SAP_FIN 618 et SAP_FIN700 sans le dernier correctif de sécurité

References

Title

Publication Time

FKIE_CVE-2024-27901

Vulnerability from fkie_nvd - Published: 2024-04-09 01:15 - Updated: 2026-06-17 07:20

Severity

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	cna@sap.com	https://me.sap.com/notes/3438234
	cna@sap.com	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
	af854a3a-2127-422b-91ae-364da2661108	https://me.sap.com/notes/3438234
	af854a3a-2127-422b-91ae-364da2661108	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP Asset Accounting",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_APPL 600"
            },
            {
              "status": "affected",
              "version": "SAP_APPL 602"
            },
            {
              "status": "affected",
              "version": "SAP_APPL 603"
            },
            {
              "status": "affected",
              "version": "SAP_APPL 604"
            },
            {
              "status": "affected",
              "version": "SAP_APPL 605"
            },
            {
              "status": "affected",
              "version": "SAP_APPL 606"
            },
            {
              "status": "affected",
              "version": "SAP_FIN617"
            },
            {
              "status": "affected",
              "version": "SAP_FIN 618"
            },
            {
              "status": "affected",
              "version": "SAP_FIN700"
            }
          ]
        }
      ],
      "source": "cna@sap.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:sap:asset_accounting:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "asset_accounting",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "sap_appl600"
            },
            {
              "status": "affected",
              "version": "sap_appl602"
            },
            {
              "status": "affected",
              "version": "sap_appl603"
            },
            {
              "status": "affected",
              "version": "sap_appl604"
            },
            {
              "status": "affected",
              "version": "sap_appl605"
            },
            {
              "status": "affected",
              "version": "sap_appl606"
            },
            {
              "status": "affected",
              "version": "sap_fin617"
            },
            {
              "status": "affected",
              "version": "sap_fin618"
            },
            {
              "status": "affected",
              "version": "sap_fin700"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API\u0027s. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\n\n"
    },
    {
      "lang": "es",
      "value": "SAP Asset Accounting podr\u00eda permitir que un atacante con altos privilegios aproveche la validaci\u00f3n insuficiente de la informaci\u00f3n de ruta proporcionada por los usuarios y la pase a las API de archivos. Provocando as\u00ed un impacto considerable en la confidencialidad, integridad y disponibilidad de la aplicaci\u00f3n."
    }
  ],
  "id": "CVE-2024-27901",
  "lastModified": "2026-06-17T07:20:33.997",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "cna@sap.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-27901",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-08-07T16:26:56.367266Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-04-09T01:15:48.993",
  "references": [
    {
      "source": "cna@sap.com",
      "url": "https://me.sap.com/notes/3438234"
    },
    {
      "source": "cna@sap.com",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://me.sap.com/notes/3438234"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-35"
        }
      ],
      "source": "cna@sap.com",
      "type": "Secondary"
    }
  ]
}

GHSA-JPMF-CHCH-C98M

Vulnerability from github – Published: 2024-04-09 03:30 – Updated: 2024-04-09 03:30

Details

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-27901"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-35"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-09T01:15:48Z",
    "severity": "HIGH"
  },
  "details": "SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API\u0027s. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\n\n",
  "id": "GHSA-jpmf-chch-c98m",
  "modified": "2024-04-09T03:30:52Z",
  "published": "2024-04-09T03:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27901"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3438234"
    },
    {
      "type": "WEB",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2024-27901

Vulnerability from gsd - Updated: 2024-02-28 06:02

Details

Aliases

CVE-2024-27901

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-27901"
      ],
      "details": "SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API\u0027s. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\n\n",
      "id": "GSD-2024-27901",
      "modified": "2024-02-28T06:02:30.893268Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cna@sap.com",
        "ID": "CVE-2024-27901",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "SAP Asset Accounting",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "SAP_APPL 600"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "SAP_APPL 602"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "SAP_APPL 603"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "SAP_APPL 604"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "SAP_APPL 605"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "SAP_APPL 606"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "SAP_FIN617"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "SAP_FIN 618"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "SAP_FIN700"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "SAP_SE"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API\u0027s. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-35",
                "lang": "eng",
                "value": "CWE-35: Path Traversal"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://me.sap.com/notes/3438234",
            "refsource": "MISC",
            "url": "https://me.sap.com/notes/3438234"
          },
          {
            "name": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364",
            "refsource": "MISC",
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API\u0027s. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.\n\n"
          },
          {
            "lang": "es",
            "value": "SAP Asset Accounting podr\u00eda permitir que un atacante con altos privilegios aproveche la validaci\u00f3n insuficiente de la informaci\u00f3n de ruta proporcionada por los usuarios y la pase a las API de archivos. Provocando as\u00ed un impacto considerable en la confidencialidad, integridad y disponibilidad de la aplicaci\u00f3n."
          }
        ],
        "id": "CVE-2024-27901",
        "lastModified": "2024-04-09T12:48:04.090",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 5.9,
              "source": "cna@sap.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-04-09T01:15:48.993",
        "references": [
          {
            "source": "cna@sap.com",
            "url": "https://me.sap.com/notes/3438234"
          },
          {
            "source": "cna@sap.com",
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
          }
        ],
        "sourceIdentifier": "cna@sap.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-35"
              }
            ],
            "source": "cna@sap.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

WID-SEC-W-2024-0811

Vulnerability from csaf_certbund - Published: 2024-04-08 22:00 - Updated: 2024-04-08 22:00

Summary

SAP Patch Day April 2024: Mehrere Schwachstellen

Severity

Hoch

Scope

12 vulnerabilities in this advisory, including CVE-2024-27901.

CVE-2024-27901

Es bestehen mehrere Schwachstellen in SAP-Software. Diese Fehler bestehen in der NetWeaver AS Java User Management Engine, der BusinessObjects Web Intelligence, der Anlagenbuchhaltung, der Edge Integration Cell, dem NetWeaver AS ABAP und der ABAP-Plattform, der Group Reporting Data Collection (Paketdaten eingeben), dem Employee Self Service, dem S/4HANA, den Business Connector Plugins und Komponenten aufgrund mehrerer sicherheitsrelevanter Probleme wie einer fehlenden Berechtigungsprüfung, einer unzureichenden Eingabevalidierung oder einer unzureichenden URL-Validierung und anderen. Ein anonymer oder authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, Cross-Site-Scripting (XSS)-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden.

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-27901 (GCVE-0-2024-27901)

BDU:2024-03124 (CVE-2024-27901)

CERTFR-2024-AVI-0283

Solution

FKIE_CVE-2024-27901

GHSA-JPMF-CHCH-C98M

GSD-2024-27901

WID-SEC-W-2024-0811

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour