PT-2024-4514 · Sap · Sap Netweaver As Java

Published 2024-02-12 · Updated 2024-10-16 · CVE-2024-24743

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS Java versions 7.50

Description: The issue is related to the incorrect restriction of XML links to external objects in the Guided Procedures component of SAP NetWeaver AS for Java. This can be exploited by a remote attacker using a specially crafted XML file to gain unauthorized access to confidential information. The attacker can submit a malicious request with the crafted XML file over the network, allowing access to sensitive files and data, though not modification. There are limits in place to prevent impact on availability.

Recommendations: For version 7.50, consider restricting access to the Guided Procedures component until a fix is available. As a temporary workaround, avoid using the XML file parsing functionality in the affected component to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2024-05018

CVE-2024-24743

Affected Products

Sap Netweaver As Java

References · 8

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05018 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-24743 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24743 · Vendor Advisory
• https://twitter.com/CVEnew/status/1757236261130018910 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1757294680616714287 · Twitter Post
• https://me.sap.com/notes/3426111 · Note
• https://vuldb.com/?id.253484 · Note