PT-2024-2864 · Sap · Sap Netweaver As Java

Published 2024-04-08 · Updated 2024-04-09 · CVE-2024-27899

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java (affected versions not specified)

Description The issue is related to the User Admin Application in SAP NetWeaver AS Java, where the self-registration and profile modification functions do not enforce proper security requirements for the content of newly defined security answers. This can be exploited by an attacker to cause significant impact on confidentiality and low impact on both integrity and availability. The vulnerability is also associated with inadequate exception handling, which can be leveraged by a remote attacker to affect the confidentiality, integrity, and availability of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

BDU:2024-03020

CVE-2024-27899

Affected Products

Sap Netweaver As Java

References · 8

• https://bdu.fstec.ru/vul/2024-03020 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-27899 · Security Note
• https://twitter.com/CVEnew/status/1777516725405438148 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Note
• https://vuldb.com/?id.259792 · Note
• https://t.me/cvenotify/76106 · Telegram Post
• https://twitter.com/cracbot/status/1777930811603382354 · Twitter Post
• https://me.sap.com/notes/3434839 · Note