PT-2024-5016 · Sap · Sap Aba

Published

2024-02-12

·

Updated

2024-10-16

·

CVE-2024-22131

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: SAP ABA (Application Basis) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I
Description: The issue in SAP ABA is related to incorrect code generation management, allowing an attacker with remote execution authorization to use a vulnerable interface and invoke application functions, potentially reading or modifying user or business data and making the system unavailable.
Recommendations: For SAP ABA (Application Basis) versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, apply the patch released by SAP as soon as possible to mitigate the potential threat. As a temporary workaround, consider restricting access to the vulnerable interface until a patch is available. Avoid using the vulnerable interface to invoke application functions until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-05540
CVE-2024-22131

Affected Products

Sap Aba