PT-2024-8858 · Sap · Sap Netweaver As Java

Published 2024-11-11 · Updated 2024-11-12 · CVE-2024-47592

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS Java (affected versions not specified)

Description: The issue allows an unauthenticated attacker to brute force the login functionality, which can lead to the identification of legitimate user IDs. This has an impact on confidentiality but not on integrity or availability. The vulnerability is related to insufficient restriction of authentication attempts.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2024-10524

CVE-2024-47592

Affected Products

Sap Netweaver As Java

References · 9

• https://cve.org/CVERecord?id=CVE-2024-47592 · Security Note
• https://bdu.fstec.ru/vul/2024-10524 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47592 · Security Note
• https://t.me/cvenotify/101327 · Telegram Post
• https://t.me/cvedetector/10557 · Telegram Post
• https://me.sap.com/notes/3393899 · Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2024.html · Note
• https://twitter.com/CVEnew/status/1856160656891773130 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note