DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
SAP Software: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-07-08
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erhöhen, Cross-Site-Scripting (XSS)-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand erzeugen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.
01
beschreibt (17)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-39600US | medium4.2 | — | ||
Under certain conditions, the memory of SAP GUI
for Windows contains the password used to log on to an SAP system, which might
allow an attacker to get hold of the password and imp… | ||||
| CVE-2024-39599US | — | — | ||
Due to a Protection Mechanism Failure in SAP
NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass
the configured malware scanner API because of a program… | ||||
| CVE-2024-39596US | —OT erhöht | — | ||
Due to missing authorization checks, SAP Enable
Now allows an author to escalate privileges to access information which should
otherwise be restricted. On successful exploitation,… | ||||
| CVE-2024-39595US | — | — | ||
SAP Business Warehouse - Business Planning and
Simulation application does not sufficiently encode user-controlled inputs,
resulting in Stored Cross-Site Scripting (XSS) vulnerabil… | ||||
| CVE-2024-39594US | — | — | ||
SAP Business Warehouse - Business Planning and
Simulation application does not sufficiently encode user controlled inputs,
resulting in Reflected Cross-Site Scripting (XSS) vulnera… | ||||
| CVE-2024-37180US | medium5.3 | — | ||
Under certain conditions SAP NetWeaver
Application Server for ABAP and ABAP Platform allows an attacker to access
remote-enabled function module with no further authorization which… | ||||
| CVE-2024-37175US | medium6.5OT erhöht | — | ||
SAP CRM WebClient does not
perform necessary authorization check for an authenticated user, resulting in
escalation of privileges. This could allow an attacker to access some sensi… | ||||
| CVE-2024-37172US | medium5.4OT erhöht | — | ||
SAP S/4HANA Finance (Advanced Payment
Management) does not perform necessary authorization check for an authenticated
user, resulting in escalation of privileges. As a result, it h… | ||||
| CVE-2024-37171US | medium5.0 | — | ||
SAP Transportation Management (Collaboration
Portal) allows an attacker with non-administrative privileges to send a crafted
request from a vulnerable web application. This will tr… | ||||
| CVE-2024-34692US | medium4.6 | — | ||
Due to missing verification of file type or
content, SAP Enable Now allows an authenticated attacker to upload arbitrary
files. These files include executables which might be downl… | ||||
| CVE-2024-34689US | medium5.0 | — | ||
WebFlow Services of SAP Business Workflow allows
an authenticated attacker to enumerate accessible HTTP endpoints in the
internal network by specially crafting HTTP requests. On su… | ||||
| CVE-2024-39598US | high7.7 | — | ||
SAP CRM (WebClient UI Framework) allows an
authenticated attacker to enumerate accessible HTTP endpoints in the internal
network by specially crafting HTTP requests. On successful… | ||||
| CVE-2024-39597US | — | — | ||
In SAP Commerce, a user can misuse the forgotten
password functionality to gain access to a Composable Storefront B2B site for
which early login and registration is activated, with… | ||||
| CVE-2024-39593US | medium5.7 | — | ||
SAP Landscape Management allows an authenticated
user to read confidential data disclosed by the REST Provider Definition
response. Successful exploitation can cause high impact on… | ||||
| CVE-2024-37174US | medium6.1 | — | ||
Custom CSS support option in SAP CRM WebClient
UI does not sufficiently encode user-controlled inputs resulting in Cross-Site
Scripting vulnerability. On successful exploitation an… | ||||
| CVE-2024-37173US | medium6.1 | — | ||
Due to insufficient input validation, SAP
CRM WebClient UI allows an unauthenticated attacker to craft a URL link which
embeds a malicious script. When a victim clicks on this… | ||||
| CVE-2024-34685US | medium6.1 | — | ||
Due to weak encoding of user-controlled input in
SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can
be executed in the application, potentially leading… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- NIST Vulnerability Database vom 2024-07-08external
- NIST Vulnerability Database vom 2024-07-08external
- NIST Vulnerability Database vom 2024-07-08external
- NIST Vulnerability Database vom 2024-07-08external
- NIST Vulnerability Database vom 2024-07-08external
- NIST Vulnerability Database vom 2024-07-08external
- NIST Vulnerability Database vom 2024-07-08external
- NIST Vulnerability Database vom 2024-07-08external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan