DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
SAP Patchday November 2024: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-11-11
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuführen und beliebigen Code auszuführen.
01
beschreibt (10)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-47595US | high7.1 | — | ||
An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploitation the attacker could cause high im… | ||||
| CVE-2024-47593US | —OT erhöht | — | ||
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possi… | ||||
| CVE-2024-47592US | — | — | ||
SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impact on confidentiality… | ||||
| CVE-2024-47590US | — | — | ||
An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used… | ||||
| CVE-2024-47588US | — | — | ||
In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An atta… | ||||
| CVE-2024-47587US | —OT erhöht | — | ||
Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confidentiality to the applica… | ||||
| CVE-2024-47586US | — | — | ||
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereferen… | ||||
| CVE-2024-42372US | —OT erhöht | — | ||
Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD configurations causing… | ||||
| CVE-2024-39592US | medium6.5OT erhöht | — | ||
Elements of PDCE does not perform necessary
authorization checks for an authenticated user, resulting in escalation of
privileges.
This
allows an attacker to read sensitive info… | ||||
| CVE-2024-33000US | —OT erhöht | — | ||
SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges. As a result, it has a low impact to confid… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan