DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
SAP Patchday Dezember 2024: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-12-09
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten zu verändern, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen.
01
beschreibt (14)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-54198US | — | — | ||
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be… | ||||
| CVE-2024-54197US | — | — | ||
SAP NetWeaver Administrator(System Overview) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On… | ||||
| CVE-2024-47585US | —OT erhöht | — | ||
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization… | ||||
| CVE-2024-47582US | — | — | ||
Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact… | ||||
| CVE-2024-47581US | —OT erhöht | — | ||
SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.There is low impac… | ||||
| CVE-2024-47578US | — | — | ||
Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems b… | ||||
| CVE-2024-47577US | —OT erhöht | — | ||
Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage th… | ||||
| CVE-2024-47576US | — | — | ||
SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Windows OS. This DLL is loaded from the computer running SAP Pr… | ||||
| CVE-2024-32732US | — | — | ||
Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This has low impact on Conf… | ||||
| CVE-2024-47590US | — | — | ||
An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used… | ||||
| CVE-2024-47586US | — | — | ||
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereferen… | ||||
| CVE-2024-42375US | medium4.3 | — | ||
SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On suc… | ||||
| CVE-2024-41731US | medium4.3 | — | ||
SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On success… | ||||
| CVE-2024-28166US | medium4.3 | — | ||
SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On suc… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan