PT-2024-1546 · Sap · Sap Web Dispatcher+1

Published 2024-01-08 · Updated 2024-01-22 · CVE-2024-22124

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Internet Communication Manager (ICM) or SAP Web Dispatcher versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22 EXT, WEBDISP 7.22 EXT, WEBDISP 7.53, WEBDISP 7.54

Description The issue is related to the lack of proper input validation when requesting an external authentication server, which could allow an attacker to access restricted information, causing a high impact on confidentiality. This can be achieved by sending a specially crafted request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-497

Related Identifiers

BDU:2024-01081

CVE-2024-22124

Affected Products

Internet Communication Manager

Sap Web Dispatcher

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-22124 · Security Note
• https://bdu.fstec.ru/vul/2024-01081 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22124 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Note
• https://t.me/cvenotify/68238 · Telegram Post
• https://me.sap.com/notes/3392626 · Note