PT-2024-8861 · Sap · Sap Netweaver Application Server For Abap/Abap Platform

Published 2024-11-11 · Updated 2024-11-12 · CVE-2024-47586

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP and ABAP Platform (affected versions not specified)

Description: The issue allows an unauthenticated attacker to send a maliciously crafted http request, which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity. The vulnerability can be exploited by a remote attacker, allowing for a denial of service.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2024-10527

CVE-2024-47586

Affected Products

Sap Netweaver Application Server For Abap/Abap Platform

References · 11

• https://cve.org/CVERecord?id=CVE-2024-47586 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47586 · Security Note
• https://bdu.fstec.ru/vul/2024-10527 · Security Note
• https://me.sap.com/notes/3504390 · Note
• https://t.me/cvedetector/10560 · Telegram Post
• https://t.me/cvenotify/101323 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2024.html · Note
• https://twitter.com/oktsec/status/1856149318513623408 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://vulners.com/cve/CVE-2024-47586 · Note
• https://twitter.com/CVEnew/status/1856160661325201720 · Twitter Post