PT-2024-3863 · Sap · Sap Cloud Connector

Fabian Hagg + 1 · Published 2024-02-12 · Updated 2024-10-16 · CVE-2024-25642

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP Cloud Connector version 2.0

Description The issue is related to improper validation of certificates in SAP Cloud Connector, allowing an attacker to impersonate genuine servers and break mutual authentication. This can lead to the interception of requests, potentially allowing the viewing or modification of sensitive information. The vulnerability affects the confidentiality and integrity of protected information, but there is no impact on system availability.

Recommendations For SAP Cloud Connector version 2.0, update the software to a version that properly validates certificates, ensuring mutual authentication is maintained to prevent impersonation attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2024-04264

CVE-2024-25642

Affected Products

Sap Cloud Connector

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-25642 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04264 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25642 · Vendor Advisory
• https://me.sap.com/notes/3424610 · Note
• https://twitter.com/CVEnew/status/1757236259116781981 · Twitter Post
• https://vuldb.com/ru/?id.253492 · Note
• https://twitter.com/arpsyndicate/status/1791994255248126047 · Twitter Post
• http://seclists.org/fulldisclosure/2024/May/26 · Note
• https://twitter.com/VulmonFeeds/status/1757294427473617310 · Twitter Post