PT-2024-3897 · Sap · Sap Ides Ecc-Systems

Published 2024-02-12 · Updated 2024-10-16 · CVE-2024-22132

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: SAP IDES ECC-systems (affected versions not specified)

Description: The issue allows the execution of arbitrary program code of a user's choice, potentially enabling an attacker to control the system's behavior by executing malicious code. This could escalate privileges, although with low impact on confidentiality, integrity, and availability of the system. The vulnerability exists due to the lack of measures to neutralize special elements used in the operating system command.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-04304

CVE-2024-22132

Affected Products

Sap Ides Ecc-Systems

References · 9

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04304 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-22132 · Security Note
• https://twitter.com/CVEnew/status/1757232449761825093 · Twitter Post
• https://t.me/cvenotify/98383 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1757295693536842067 · Twitter Post
• https://vuldb.com/?id.253493 · Note
• https://t.me/cvenotify/71184 · Telegram Post
• https://me.sap.com/notes/3421659 · Note