PT-2024-2957 · Sap · Sap Asset Accounting

Published 2024-04-08 · Updated 2024-04-09 · CVE-2024-27901

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP Asset Accounting (affected versions not specified)

Description The issue is related to insufficient validation of path information provided by users, which can be exploited by a high-privileged attacker to impact the confidentiality, integrity, and availability of the application. This can be achieved by passing the path information through to the file API's. The exploitation may involve a specially crafted HTML page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-35

Related Identifiers

BDU:2024-03124

CVE-2024-27901

Affected Products

Sap Asset Accounting

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-27901 · Security Note
• https://bdu.fstec.ru/vul/2024-03124 · Security Note
• https://twitter.com/CVEnew/status/1777516724230975970 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Note
• https://twitter.com/cracbot/status/1777930814468087892 · Twitter Post
• https://t.me/cvenotify/76107 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2024.html · Note
• https://me.sap.com/notes/3438234 · Note