Vulnerability-Lookup

CVE-2024-33006 (GCVE-0-2024-33006)

Vulnerability from cvelistv5 – Published: 2024-05-14 04:16 – Updated: 2025-12-16 18:13

Title

File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

Summary

An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-17 04:00 UTC

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

sap CNA under the mitre root

CNA scorecard C 65/100 over 117 records in the last 180 days details

References

2 references

URL	Tags
https://me.sap.com/notes/3448171
https://support.sap.com/en/my-support/knowledge-b…

Impacted products

6 products

Vendor	Product	Version	CPE status
SAP_SE	SAP NetWeaver Application Server ABAP and ABAP Platform	Affected: SAP_BASIS 700 Affected: SAP_BASIS 701 Affected: SAP_BASIS 702 Affected: SAP_BASIS 731 Affected: SAP_BASIS 740 Affected: SAP_BASIS 750 Affected: SAP_BASIS 751 Affected: SAP_BASIS 752 Affected: SAP_BASIS 753 Affected: SAP_BASIS 754 Affected: SAP_BASIS 755 Affected: SAP_BASIS 756 Affected: SAP_BASIS 757 Affected: SAP_BASIS 758	guessed
sap	netweaver	Affected: 754 cpe:2.3:a:sap:netweaver:754:::::::*
sap	netweaver	Affected: 755 cpe:2.3:a:sap:netweaver:755:::::::*
sap	netweaver	Affected: 756 cpe:2.3:a:sap:netweaver:756:::::::*
sap	netweaver	Affected: 757 cpe:2.3:a:sap:netweaver:757:::::::*
sap	netweaver	Affected: 758 cpe:2.3:a:sap:netweaver:758:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:sap:netweaver:754:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netweaver",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "754"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap:netweaver:755:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netweaver",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "755"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap:netweaver:756:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netweaver",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "756"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap:netweaver:757:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netweaver",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "757"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:sap:netweaver:758:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "netweaver",
            "vendor": "sap",
            "versions": [
              {
                "status": "affected",
                "version": "758"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-33006",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-17T04:00:35.814972Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-16T18:13:19.922Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:27:53.232Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3448171"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver Application Server ABAP and ABAP Platform",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_BASIS 700"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 701 "
            },
            {
              "status": "affected",
              "version": "SAP_BASIS  702 "
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 731"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 740"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 750"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 751"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 752"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 753"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 754"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 755"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 756"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 757"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 758 "
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nAn unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.\u00a0\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-14T04:16:06.647Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3448171"
        },
        {
          "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2024-33006",
    "datePublished": "2024-05-14T04:16:06.647Z",
    "dateReserved": "2024-04-23T04:04:25.521Z",
    "dateUpdated": "2025-12-16T18:13:19.922Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-33006",
      "date": "2026-10-20",
      "epss": "0.00527",
      "percentile": "0.4352"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "SAP NetWeaver Application Server ABAP and ABAP Platform",
                "vendor": "SAP_SE",
                "versions": [
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 700"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 701 "
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS  702 "
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 731"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 740"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 750"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 751"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 752"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 753"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 754"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 755"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 756"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 757"
                  },
                  {
                    "status": "affected",
                    "version": "SAP_BASIS 758 "
                  }
                ]
              }
            ],
            "source": "cna@sap.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:sap:netweaver:754:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netweaver",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "754"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:netweaver:755:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netweaver",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "755"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:netweaver:756:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netweaver",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "756"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:netweaver:757:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netweaver",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "757"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:netweaver:758:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netweaver",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "758"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "\nAn unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.\u00a0\n\n"
          },
          {
            "lang": "es",
            "value": "Un atacante no autenticado puede cargar un archivo malicioso en el servidor al que, cuando una v\u00edctima accede, puede permitir que un atacante comprometa completamente el sistema."
          }
        ],
        "id": "CVE-2024-33006",
        "lastModified": "2026-06-17T07:30:51.927",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.6,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 6.0,
              "source": "cna@sap.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-33006",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-17T04:00:35.814972Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-14T16:17:14.250",
        "references": [
          {
            "source": "cna@sap.com",
            "url": "https://me.sap.com/notes/3448171"
          },
          {
            "source": "cna@sap.com",
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://me.sap.com/notes/3448171"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
          }
        ],
        "sourceIdentifier": "cna@sap.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-434"
              }
            ],
            "source": "cna@sap.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T20:02:54+00:00",
      "cve": "CVE-2024-33006",
      "id": "CVE-2024-33006",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-33006.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T02:27:53.232Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://me.sap.com/notes/3448171"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:sap:netweaver:754:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netweaver",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "754"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:netweaver:755:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netweaver",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "755"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:netweaver:756:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netweaver",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "756"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:netweaver:757:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netweaver",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "757"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:sap:netweaver:758:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "netweaver",
                "vendor": "sap",
                "versions": [
                  {
                    "status": "affected",
                    "version": "758"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-33006",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-17T04:00:35.814972Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-17T12:16:01.701Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "SAP NetWeaver Application Server ABAP and ABAP Platform",
              "vendor": "SAP_SE",
              "versions": [
                {
                  "status": "affected",
                  "version": "SAP_BASIS 700"
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS 701 "
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS  702 "
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS 731"
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS 740"
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS 750"
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS 751"
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS 752"
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS 753"
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS 754"
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS 755"
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS 756"
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS 757"
                },
                {
                  "status": "affected",
                  "version": "SAP_BASIS 758 "
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\n\n"
                }
              ],
              "value": "\nAn unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.\u00a0\n\n"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.6,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-434",
                  "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-05-14T04:16:06.647Z",
            "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
            "shortName": "sap"
          },
          "references": [
            {
              "url": "https://me.sap.com/notes/3448171"
            },
            {
              "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "assignerShortName": "sap",
        "cveId": "CVE-2024-33006",
        "datePublished": "2024-05-14T04:16:06.647Z",
        "dateReserved": "2024-04-23T04:04:25.521Z",
        "dateUpdated": "2025-12-16T18:13:19.922Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2024-AVI-0395

Vulnerability from certfr_avis - Published: 2024-05-14 - Updated: 2024-05-14

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
SAP	N/A	Enable Now version 1704 sans le dernier correctif de sécurité
SAP	N/A	Business Client versions 6.5, 7.0 et 7.70 sans le dernier correctif de sécurité
SAP	N/A	NetWeaver Application server for ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 795 et SAP_BASIS 796 sans le dernier correctif de sécurité
SAP	N/A	SAPUI5 versions 754, 755, 756, 757 et 758 sans le dernier correctif de sécurité
SAP	N/A	Commerce version HY_COM 2205 sans le dernier correctif de sécurité
SAP	N/A	AP S/4 HANA (Manage Bank Statement Reprocessing Rules) versions SAPSCORE 131, S4CORE 105, S4CORE 106, S4CORE107 et S4CORE 108 sans le dernier correctif de sécurité
SAP	N/A	AP BusinessObjects Business Intelligence Platform (Webservices) versions 430 et 440 sans le dernier correctif de sécurité
SAP	Replication Server	AP Replication Server versions 16.0, 16.0.3 et 16.0.4 sans le dernier correctif de sécurité
SAP	N/A	S/4HANA (Document Service Handler for DPS) versions SAP_BASIS 740 et SAP_BASIS 750 sans le dernier correctif de sécurité
SAP	N/A	My Travel Requests version 600 sans le dernier correctif de sécurité
SAP	N/A	BusinessObjects (Business Intelligence Platform) versions 430 et 440 sans le dernier correctif de sécurité
SAP	N/A	AP Bank Account Management versions 100, 101, 102, 103, 104, 105, 106, 107 et 108 sans le dernier correctif de sécurité
SAP	N/A	AP Global Label Management (GLM) versions 605, 606, 616 et 617 sans le dernier correctif de sécurité

References

Title

Publication Time

CNVD-2024-35658

Vulnerability from cnvd - Published: 2024-08-19

Title

SAP NetWeaver Application Server文件上传漏洞

Description

SAP NetWeaver Application Server是德国思爱普（SAP）公司的一款应用程序服务器。 SAP NetWeaver Application Server ABAP Platform存在文件上传漏洞，该漏洞源于应用对上传的文件缺少有效的验证。攻击者可利用该漏洞上传恶意文件从而远程执行任意代码。

Severity

高

Patch Name

SAP NetWeaver Application Server文件上传漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2024.html

Reference

https://me.sap.com/notes/3448171

Impacted products

Name
SAP SAP NetWeaver Application Server

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-33006",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-33006"
    }
  },
  "description": "SAP NetWeaver Application Server\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u5e94\u7528\u7a0b\u5e8f\u670d\u52a1\u5668\u3002\n\nSAP NetWeaver Application Server ABAP Platform\u5b58\u5728\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5e94\u7528\u5bf9\u4e0a\u4f20\u7684\u6587\u4ef6\u7f3a\u5c11\u6709\u6548\u7684\u9a8c\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4e0a\u4f20\u6076\u610f\u6587\u4ef6\u4ece\u800c\u8fdc\u7a0b\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2024.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-35658",
  "openTime": "2024-08-19",
  "patchDescription": "SAP NetWeaver Application Server\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u5e94\u7528\u7a0b\u5e8f\u670d\u52a1\u5668\u3002\r\n\r\nSAP NetWeaver Application Server ABAP Platform\u5b58\u5728\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5e94\u7528\u5bf9\u4e0a\u4f20\u7684\u6587\u4ef6\u7f3a\u5c11\u6709\u6548\u7684\u9a8c\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4e0a\u4f20\u6076\u610f\u6587\u4ef6\u4ece\u800c\u8fdc\u7a0b\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP NetWeaver Application Server\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "SAP SAP NetWeaver Application Server"
  },
  "referenceLink": "https://me.sap.com/notes/3448171",
  "serverity": "\u9ad8",
  "submitTime": "2024-05-30",
  "title": "SAP NetWeaver Application Server\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e"
}

FKIE_CVE-2024-33006

Vulnerability from fkie_nvd - Published: 2024-05-14 16:17 - Updated: 2026-06-17 07:30

Severity

9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Summary

An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.

References

	URL	Tags
	cna@sap.com	https://me.sap.com/notes/3448171
	cna@sap.com	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
	af854a3a-2127-422b-91ae-364da2661108	https://me.sap.com/notes/3448171
	af854a3a-2127-422b-91ae-364da2661108	https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP NetWeaver Application Server ABAP and ABAP Platform",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "SAP_BASIS 700"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 701 "
            },
            {
              "status": "affected",
              "version": "SAP_BASIS  702 "
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 731"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 740"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 750"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 751"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 752"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 753"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 754"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 755"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 756"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 757"
            },
            {
              "status": "affected",
              "version": "SAP_BASIS 758 "
            }
          ]
        }
      ],
      "source": "cna@sap.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:sap:netweaver:754:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "netweaver",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "754"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:netweaver:755:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "netweaver",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "755"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:netweaver:756:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "netweaver",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "756"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:netweaver:757:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "netweaver",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "757"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:sap:netweaver:758:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "netweaver",
          "vendor": "sap",
          "versions": [
            {
              "status": "affected",
              "version": "758"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nAn unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.\u00a0\n\n"
    },
    {
      "lang": "es",
      "value": "Un atacante no autenticado puede cargar un archivo malicioso en el servidor al que, cuando una v\u00edctima accede, puede permitir que un atacante comprometa completamente el sistema."
    }
  ],
  "id": "CVE-2024-33006",
  "lastModified": "2026-06-17T07:30:51.927",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "cna@sap.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-33006",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-05-17T04:00:35.814972Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-05-14T16:17:14.250",
  "references": [
    {
      "source": "cna@sap.com",
      "url": "https://me.sap.com/notes/3448171"
    },
    {
      "source": "cna@sap.com",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://me.sap.com/notes/3448171"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "cna@sap.com",
      "type": "Secondary"
    }
  ]
}

GHSA-RPJH-2PX8-R4M7

Vulnerability from github – Published: 2024-05-14 18:31 – Updated: 2024-05-14 18:31

Details

An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.

Severity

9.6 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-33006"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T16:17:14Z",
    "severity": "CRITICAL"
  },
  "details": "\nAn unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.\u00a0\n\n",
  "id": "GHSA-rpjh-2px8-r4m7",
  "modified": "2024-05-14T18:31:00Z",
  "published": "2024-05-14T18:31:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33006"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3448171"
    },
    {
      "type": "WEB",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2024-33006

Vulnerability from gsd - Updated: 2024-04-24 05:02

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2024-33006

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-33006"
      ],
      "id": "GSD-2024-33006",
      "modified": "2024-04-24T05:02:09.763047Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2024-33006",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

NCSC-2024-0228

Vulnerability from csaf_ncscnl - Published: 2024-05-17 11:28 - Updated: 2024-05-17 11:28

Summary

Kwetsbaarheden verholpen in SAP producten

Scope

15 vulnerabilities in this advisory, including CVE-2024-33006.

CVE-2024-33006

Open the full advisory

WID-SEC-W-2024-1107

Vulnerability from csaf_certbund - Published: 2024-05-13 22:00 - Updated: 2024-05-13 22:00

Summary

SAP Software: Mehrere Schwachstellen

Severity

Hoch

Scope

16 vulnerabilities in this advisory, including CVE-2024-33006.

CVE-2024-33006

In SAP Software existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Produkten, einschließlich dem Business Client, Netweaver, BusinessObjects und mehr, aufgrund fehlender Autorisierungsprüfungen, fehlerhafter Eingabevalidierung oder eines Relative Path Overwrite-Problems. Ein entfernter Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, oder vertrauliche Informationen offenzulegen. Einige dieser Schwachstellen erfordern entweder Benutzerinteraktion oder Privilegien für eine erfolgreiche Ausnutzung.

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-33006 (GCVE-0-2024-33006)

CERTFR-2024-AVI-0395

Solution

CNVD-2024-35658

FKIE_CVE-2024-33006

GHSA-RPJH-2PX8-R4M7

GSD-2024-33006

NCSC-2024-0228

WID-SEC-W-2024-1107

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour