DeutschShown in its original language — a full translation is planned for a future version.
SAP Patchday September 2024
view advisory published 2024-09-09
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu erzeugen oder einen Cross-Site-Scripting-Angriff durchzuführen.
01
describes (26)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-45285US | —OT elevated | — | ||
The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes. By sending a crafted packet in the… | ||||
| CVE-2024-45284US | —OT elevated | — | ||
An authenticated attacker with high privilege can use functions of SLCM transactions to which access should be restricted. This may result in an escalation of privileges causing lo… | ||||
| CVE-2024-45283US | — | — | ||
SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an RFC destination. After… | ||||
| CVE-2024-45281US | — | — | ||
SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally signed or if the signa… | ||||
| CVE-2024-45280US | — | — | ||
Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confide… | ||||
| CVE-2024-45279US | — | — | ||
Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker to craft a URL link wh… | ||||
| CVE-2024-44121US | — | — | ||
Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted. The vulnerability cou… | ||||
| CVE-2024-44120US | — | — | ||
SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attacker could craft a mal… | ||||
| CVE-2024-44117US | —OT elevated | — | ||
The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ID. There is low impa… | ||||
| CVE-2024-45286US | —OT elevated | — | ||
Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Production and Revenue Accounting allows unauthorized access that… | ||||
| CVE-2024-44112US | medium4.3OT elevated | — | ||
Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative user could call a remote-enabled functi… | ||||
| CVE-2024-41728US | low2.7OT elevated | — | ||
Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package.… | ||||
| CVE-2024-44116US | —OT elevated | — | ||
The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to identify usernames and… | ||||
| CVE-2024-44115US | —OT elevated | — | ||
The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access i… | ||||
| CVE-2024-44114US | low2.7OT elevated | — | ||
SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This results in a minimal impa… | ||||
| CVE-2024-44113US | —OT elevated | — | ||
Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is otherwise restricted. On… | ||||
| CVE-2024-42380US | —OT elevated | — | ||
The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each node. Usernames can be e… | ||||
| CVE-2024-42378US | — | — | ||
Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to a Reflected Cross-Sit… | ||||
| CVE-2024-42371US | —OT elevated | — | ||
The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify usernames and access i… | ||||
| CVE-2024-41729US | —OT elevated | — | ||
Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitat… | ||||
showing 20 of 26
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan