Code Injection vulnerability in SAP ABA (Application Basis) (SAP_SE SAP ABA (Application Basis))
En bref
- Source
- NVD
- EPSS
- EPSS 1.08 % · centile 65 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Modified
Description
In SAP ABA (Application Basis) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authorization can use a vulnerable interface. This allows the attacker to use the interface to invoke an application function to perform actions which they would not normally be permitted to perform.  Depending on the function executed, the attack can read or modify any user/business data and can make the entire system unavailable.
Faiblesses (CWE)
- CWE-94 — Injection de code
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | sap |
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-19727
- GCVE · GCVE-0-2024-22131
Avis du CERT-FR
- CERTFR-2024-AVI-0125 — Multiples vulnérabilités dans SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:abap_platform:75c:*:*:*:*:*:*:*cpe:2.3:a:sap:abap_platform:75i:*:*:*:*:*:*:*cpe:2.3:a:sap:abap_platform:700:*:*:*:*:*:*:*cpe:2.3:a:sap:abap_platform:701:*:*:*:*:*:*:*cpe:2.3:a:sap:abap_platform:702:*:*:*:*:*:*:*cpe:2.3:a:sap:abap_platform:731:*:*:*:*:*:*:*cpe:2.3:a:sap:abap_platform:740:*:*:*:*:*:*:*cpe:2.3:a:sap:abap_platform:750:*:*:*:*:*:*:*cpe:2.3:a:sap:abap_platform:751:*:*:*:*:*:*:*cpe:2.3:a:sap:abap_platform:752:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP ABA (Application Basis) | affected 700 ; affected 701 ; affected 702 ; affected 731 ; affected 740 ; affected 750 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |