DeutschShown in its original language — a full translation is planned for a future version.
SAP Security Patch Day – August 2024
view advisory published 2024-08-12
Ein Angreifer kann mehrere Schwachstellen in der SAP-Software ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu löschen oder zu manipulieren oder einen Cross Site Scripting-Angriff durchzuführen.
01
describes (17)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-42373US | medium5.4OT elevated | — | ||
SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful expl… | ||||
| CVE-2024-41734US | medium4.3OT elevated | — | ||
Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclo… | ||||
| CVE-2024-39591US | medium5.3OT elevated | — | ||
SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact on confidentiality of… | ||||
| CVE-2024-42377US | medium4.3OT elevated | — | ||
SAP shared service framework allows an
authenticated non-administrative user to call a remote-enabled function, which
will allow them to insert value entries into a non-sensitive t… | ||||
| CVE-2024-42376US | medium6.5OT elevated | — | ||
SAP Shared Service Framework does not perform necessary
authorization check for an authenticated user, resulting in escalation of
privileges. On successful exploitation, an attacke… | ||||
| CVE-2024-42375US | medium4.3 | — | ||
SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On suc… | ||||
| CVE-2024-42374US | high8.2 | — | ||
BEx Web Java Runtime Export Web Service does not
sufficiently validate an XML document accepted from an untrusted source. An
attacker can retrieve information from the SAP ADS syst… | ||||
| CVE-2024-41737US | medium5.0 | — | ||
SAP CRM ABAP (Insights
Management) allows an authenticated attacker to enumerate HTTP endpoints in the
internal network by specially crafting HTTP requests. On successful
exploitat… | ||||
| CVE-2024-41736US | medium4.3 | — | ||
Under certain conditions SAP Permit to Work
allows an authenticated attacker to access information which would otherwise be
restricted causing low impact on the confidentiality of… | ||||
| CVE-2024-41735US | medium5.4 | — | ||
SAP Commerce Backoffice does not sufficiently
encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)
vulnerability causing low impact on confidentiality and integri… | ||||
| CVE-2024-41733US | medium5.3 | — | ||
In SAP Commerce, valid user accounts can be
identified during the customer registration and login processes. This allows a
potential attacker to learn if a given e-mail is used for… | ||||
| CVE-2024-41732US | medium5.4 | — | ||
SAP NetWeaver Application Server ABAP allows
an unauthenticated attacker to craft a URL link that could bypass allowlist
controls. Depending on the web applications provided by… | ||||
| CVE-2024-41731US | medium4.3 | — | ||
SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On success… | ||||
| CVE-2024-41730US | critical9.8OT high | — | ||
In SAP BusinessObjects Business Intelligence
Platform, if Single Signed On is enabled on Enterprise authentication, an
unauthorized user can get a logon token using a REST endpoint… | ||||
| CVE-2024-33005US | medium6.3OT elevated | — | ||
Due to the missing authorization checks in the
local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application
Server (ABAP and Java), and SAP Content Server can im… | ||||
| CVE-2024-33003US | critical9.1 | — | ||
Some OCC API endpoints in SAP Commerce Cloud
allows Personally Identifiable Information (PII) data, such as passwords, email
addresses, mobile numbers, coupon codes, and voucher co… | ||||
| CVE-2024-28166US | medium4.3 | — | ||
SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On suc… | ||||
02
references
External citations — patches, advisories, analysis.
- NIST Vulnerability Database vom 2024-08-12external
- NIST Vulnerability Database vom 2024-08-12external
- NIST Vulnerability Database vom 2024-08-12external
- NIST Vulnerability Database vom 2024-08-12external
- NIST Vulnerability Database vom 2024-08-12external
- NIST Vulnerability Database vom 2024-08-12external
- NIST Vulnerability Database vom 2024-08-12external
- NIST Vulnerability Database vom 2024-08-12external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan