PT-2024-9896 · Sap · Sap Transportation Management

Published 2024-07-08 · Updated 2024-09-09 · CVE-2024-37171

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP Transportation Management (Collaboration Portal) (affected versions not specified)

Description: The issue allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web application, triggering the application handler to send a request to an unintended service. This may reveal information about that service, which could be used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. There is no effect on the integrity or availability of the application.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2025-00005

CVE-2024-37171

Affected Products

Sap Transportation Management

References · 11

• https://bdu.fstec.ru/vul/2025-00005 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-37171 · Security Note
• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37171 · Vendor Advisory
• https://feedly.com/cve/CVE-2024-37171 · Note
• https://t.me/cvenotify/85456 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2024.html · Note
• https://me.sap.com/notes/3469958 · Note
• https://t.me/cvedetector/249 · Telegram Post
• https://twitter.com/CVEnew/status/1810533092991652004 · Twitter Post
• https://t.me/cvenotify/93822 · Telegram Post