Skip to content
OpenAdvisories
High NCSC-2024-0247 10 CVEs

Kwetsbaarheden verholpen in SAP producten

Published Jun 11, 2024 · Updated Jun 11, 2024 · nl

Vendor: SAP Product: bw4hana_transformation_and_data_transfer_process Product: CRM (WebClient UI) Product: document_builder Product: financial_consolidation Product: NetWeaver AS Java Product: netweaver_application_server_abap Product: SAP BusinessObjects Business Intelligence Platform Product: SAP BW/4HANA Transformation and Data Transfer Process Product: SAP CRM (WebClient UI) Product: SAP Document Builder Product: SAP Financial Consolidation Product: SAP NetWeaver and ABAP Platform Product: SAP NetWeaver AS Java Product: SAP S/4HANA (Manage Incoming Payment Files) Product: SAP Student Life Cycle Management Product: student_life_cycle_management

Summary

SAP heeft kwetsbaarheden verholpen in diverse SAP producten, zoals Business Objects, HANA, CRM en NetWeaver.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:

- Denial-of-Service (DoS)
- Omzeilen van authenticatie
- Cross-Site-Scripting (XSS)
- Manipulatie van gegevens
- Toegang tot gevoelige gegevens

Oplossingen
SAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen in de kwetsbare producten. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 10

  • High 8.1
    CVE-2024-37177

    Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation

    SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause sign…

    SAP SAP Financial Consolidation
  • High 7.5
    CVE-2024-34688

    Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)

    Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users from accessing it. This can result in no impact on confidentiality and integrit…

    SAP SAP NetWeaver AS Java
  • Medium 6.5
    CVE-2024-33001

    Denial of service (DOS) in SAP NetWeaver and ABAP platform

    SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial of Service vulnerability might be long response delays and service interruptions, thus degrading the se…

    SAP SAP NetWeaver and ABAP Platform
  • Medium 6.5
    CVE-2024-34683

    Unrestricted file upload in SAP Document Builder (HTTP service)

    An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victim’s browser.

    SAP SAP Document Builder
  • Medium 6.5
    CVE-2024-34691

    Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files)

    Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact on integrity and no impact on the confidentiality and availa…

    SAP SAP S/4HANA (Manage Incoming Payment Files)
  • Medium 6.1
    CVE-2024-34686

    Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)

    Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the a…

    SAP SAP CRM (WebClient UI)
  • Medium 5.5
    CVE-2024-37176

    Missing Authorization check in SAP BW/4HANA Transformation and DTP

    SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the conf…

    SAP SAP BW/4HANA Transformation and Data Transfer Process
  • Medium 5.4
    CVE-2024-34690

    Missing Authorization check in SAP Student Life Cycle Management (SLcM)

    SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to access and edit non-sensitive report var…

    SAP SAP Student Life Cycle Management
  • Medium 5.3
    CVE-2024-28164

    Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures)

    SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low impact on confidentiality of the application.

    SAP SAP NetWeaver AS Java
  • Low 3.7
    CVE-2024-34684

    Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Scheduling)

    On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to access the password of a local account. As a result, an attacker can obtain non-administrative user cred…

    SAP SAP BusinessObjects Business Intelligence Platform

Revision history

  1. #0

    Initiele versie

References

  • Source - sap
    https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2024.html