Description
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP_SE | SAP NetWeaver Application Server ABAP | KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.54, 7.77, 7.89, 7.93 | — |
Advisories 2
- NCSC-2024-0472 Kwetsbaarheden verholpen in SAP producten NCSC-NL (Netherlands) · Dec 10, 2024
- WID-SEC-2024-3640 SAP Patchday Dezember 2024: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 9, 2024