PT-2024-19217 · Sap · Sap Netweaver Administrator As Java

Published 2024-03-11 · Updated 2024-11-20 · CVE-2024-22127

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) version 7.50

Description The issue allows an attacker with high privileges to upload potentially dangerous files, which leads to a command injection vulnerability. This would enable the attacker to run commands that can cause high impact on confidentiality, integrity, and availability of the application. The vulnerability is actively exploited.

Recommendations For SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) version 7.50, consider disabling the file upload feature until a patch is available to prevent command injection attacks. Restrict access to the Administrator Log Viewer plug-in to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-22127

Affected Products

Sap Netweaver Administrator As Java

References · 27

• https://osv.dev/vulnerability/CVE-2024-22127 · Vendor Advisory
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22127 · Security Note
• https://twitter.com/transilienceai/status/1858737321887023203 · Twitter Post
• https://twitter.com/transilienceai/status/1858561493220155860 · Twitter Post
• https://twitter.com/iSecurity/status/1846919490766098699 · Twitter Post
• https://twitter.com/Mr_Ronne/status/1847298502977814911 · Twitter Post
• https://twitter.com/CVEnew/status/1767355130930675928 · Twitter Post
• https://twitter.com/transilienceai/status/1856386560582922616 · Twitter Post
• https://t.me/cvenotify/73516 · Telegram Post
• https://twitter.com/transilienceai/status/1855661287772155935 · Twitter Post
• https://twitter.com/transilienceai/status/1856929661315350941 · Twitter Post
• https://twitter.com/transilienceai/status/1859099405787316529 · Twitter Post
• https://me.sap.com/notes/3433192 · Note
• https://twitter.com/transilienceai/status/1854935899177730166 · Twitter Post