PT-2024-9306 · Sap · Sap Netweaver Administrator

Published 2024-12-02 · Updated 2024-12-10 · CVE-2024-54197

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Administrator (affected versions not specified)

Description: The issue allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests, potentially resulting in Server-Side Request Forgery (SSRF). This could have a low impact on the integrity and confidentiality of data, with no impact on the availability of the application. The vulnerability is related to insufficient server-side request checking.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2024-10995

CVE-2024-54197

Affected Products

Sap Netweaver Administrator

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-54197 · Security Note
• https://bdu.fstec.ru/vul/2024-10995 · Security Note
• https://twitter.com/VulmonFeeds/status/1866320543533748670 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2024.html · Note
• https://twitter.com/CVEnew/status/1866432917733351694 · Twitter Post
• https://vuldb.com/?id.287492 · Note
• https://t.me/cvenotify/103687 · Telegram Post
• https://t.me/cvedetector/12462 · Telegram Post
• https://url.sap/sapsecuritypatchday · Note
• https://t.me/latest_high_impact_cve/1628 · Telegram Post
• https://me.sap.com/notes/3542543 · Note
• https://twitter.com/vuldb/status/1866371658493370749 · Twitter Post