NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in SAP producten
view advisory published 2024-06-11
SAP heeft kwetsbaarheden verholpen in diverse SAP producten, zoals Business Objects, HANA, CRM en NetWeaver.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-37176US | medium5.4OT elevated | — | ||
SAP BW/4HANA Transformation and Data Transfer
Process (DTP) allows an authenticated attacker to gain higher access levels
than they should have by exploiting improper authorization… | ||||
| CVE-2024-34691US | medium6.5OT elevated | — | ||
Manage Incoming Payment Files (F1680) of SAP
S/4HANA does not perform necessary authorization checks for an authenticated
user, resulting in escalation of privileges. As a result,… | ||||
| CVE-2024-34690US | medium5.4OT elevated | — | ||
SAP Student Life Cycle
Management (SLcM) fails to conduct proper authorization checks for
authenticated users, leading to the potential escalation of privileges. On
successful expl… | ||||
| CVE-2024-34688US | high7.5 | — | ||
Due to unrestricted access to the Meta Model
Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks
on the application, which may prevent legitimate users… | ||||
| CVE-2024-34686US | medium6.1 | — | ||
Due to insufficient input validation, SAP CRM
WebClient UI allows an unauthenticated attacker to craft a URL link which
embeds a malicious script. When a victim clicks on this link… | ||||
| CVE-2024-34684US | medium6.0 | — | ||
On Unix, SAP BusinessObjects Business
Intelligence Platform (Scheduling) allows an authenticated attacker with
administrator access on the local server to access the password of a… | ||||
| CVE-2024-34683US | medium6.5 | — | ||
An authenticated attacker can upload malicious
file to SAP Document Builder service. When the victim accesses this file, the
attacker is allowed to access, modify, or make the rela… | ||||
| CVE-2024-33001US | medium6.5 | — | ||
SAP NetWeaver and ABAP platform allows an
attacker to impede performance for legitimate users by crashing or flooding the
service.
An
impact of this Denial of Service vulnerabil… | ||||
| CVE-2024-28164US | medium5.3 | — | ||
SAP NetWeaver AS Java (CAF - Guided Procedures)
allows an unauthenticated user to access non-sensitive information about the
server which would otherwise be restricted causing low… | ||||
| CVE-2024-37177US | — | — | ||
SAP Financial Consolidation allows data to enter
a Web application through an untrusted source. These endpoints are exposed over
the network and it allows the user to modify the co… | ||||
02
references
External citations — patches, advisories, analysis.
- Source - sapexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan