Lucene search

SapCVE-2024-33005

HistoryAug 13, 2024 - 4:15 a.m.

CVE-2024-33005

2024-08-1304:15:07

CWE-862

sap

web.nvd.nist.gov

authorization checks

admin users

impersonation

confidentiality

integrity

availability

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

AI Score

6.3

Confidence

High

EPSS

Percentile

9.5%

JSON

Due to the missing authorization checks in the
local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application
Server (ABAP and Java), and SAP Content Server can impersonate other users and
may perform some unintended actions. This could lead to a low impact on
confidentiality and a high impact on the integrity and availability of the
applications.

Affected configurations

Nvd

Node

sapnetweaver_abapMatchkernel_7.22

sapnetweaver_abapMatchkernel_7.53

sapnetweaver_abapMatchkernel_7.54

sapnetweaver_abapMatchkernel_7.77

sapnetweaver_abapMatchkernel_7.85

sapnetweaver_abapMatchkernel_7.89

sapnetweaver_abapMatchkernel_7.93

sapnetweaver_abapMatchkrnl64nuc_7.22

sapnetweaver_abapMatchkrnl64nuc_7.22ext

sapnetweaver_abapMatchkrnl64uc_7.22

sapnetweaver_abapMatchkrnl64uc_7.22ext

sapnetweaver_abapMatchkrnl64uc_7.53

Node

sapnetweaver_javaMatchkernel_7.22

sapnetweaver_javaMatchkernel_7.53

sapnetweaver_javaMatchkernel_7.54

sapnetweaver_javaMatchkernel_7.77

sapnetweaver_javaMatchkernel_7.85

sapnetweaver_javaMatchkernel_7.89

sapnetweaver_javaMatchkernel_7.93

sapnetweaver_javaMatchkrnl64nuc_7.22

sapnetweaver_javaMatchkrnl64nuc_7.22ext

sapnetweaver_javaMatchkrnl64uc_7.22

sapnetweaver_javaMatchkrnl64uc_7.22ext

sapnetweaver_javaMatchkrnl64uc_7.53

Node

sapcontent_serverMatchkernel_7.22

sapcontent_serverMatchkernel_7.53

sapcontent_serverMatchkernel_7.54

sapcontent_serverMatchkernel_7.77

sapcontent_serverMatchkernel_7.85

sapcontent_serverMatchkernel_7.89

sapcontent_serverMatchkernel_7.93

sapcontent_serverMatchkrnl64nuc_7.22

sapcontent_serverMatchkrnl64nuc_7.22ext

sapcontent_serverMatchkrnl64uc_7.22

sapcontent_serverMatchkrnl64uc_7.22ext

sapcontent_serverMatchkrnl64uc_7.53

Node

sapweb_dispatcherMatchkernel_7.22

sapweb_dispatcherMatchkernel_7.53

sapweb_dispatcherMatchkernel_7.54

sapweb_dispatcherMatchkernel_7.77

sapweb_dispatcherMatchkernel_7.85

sapweb_dispatcherMatchkernel_7.89

sapweb_dispatcherMatchkernel_7.93

sapweb_dispatcherMatchkrnl64nuc_7.22

sapweb_dispatcherMatchkrnl64nuc_7.22ext

sapweb_dispatcherMatchkrnl64uc_7.22

sapweb_dispatcherMatchkrnl64uc_7.22ext

sapweb_dispatcherMatchkrnl64uc_7.53

sapweb_dispatcherMatchwebdisp_7.22_ext

sapweb_dispatcherMatchwebdisp_7.53

sapweb_dispatcherMatchwebdisp_7.54

sapweb_dispatcherMatchwebdisp_7.77

sapweb_dispatcherMatchwebdisp_7.85

sapweb_dispatcherMatchwebdisp_7.89

sapweb_dispatcherMatchwebdisp_7.93

VendorProductVersionCPE
sapnetweaver_abapkernel_7.22cpe:2.3:a:sap:netweaver_abap:kernel_7.22:*:*:*:*:*:*:*
sapnetweaver_abapkernel_7.53cpe:2.3:a:sap:netweaver_abap:kernel_7.53:*:*:*:*:*:*:*
sapnetweaver_abapkernel_7.54cpe:2.3:a:sap:netweaver_abap:kernel_7.54:*:*:*:*:*:*:*
sapnetweaver_abapkernel_7.77cpe:2.3:a:sap:netweaver_abap:kernel_7.77:*:*:*:*:*:*:*
sapnetweaver_abapkernel_7.85cpe:2.3:a:sap:netweaver_abap:kernel_7.85:*:*:*:*:*:*:*
sapnetweaver_abapkernel_7.89cpe:2.3:a:sap:netweaver_abap:kernel_7.89:*:*:*:*:*:*:*
sapnetweaver_abapkernel_7.93cpe:2.3:a:sap:netweaver_abap:kernel_7.93:*:*:*:*:*:*:*
sapnetweaver_abapkrnl64nuc_7.22cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22:*:*:*:*:*:*:*
sapnetweaver_abapkrnl64nuc_7.22extcpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:*
sapnetweaver_abapkrnl64uc_7.22cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.22:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	netweaver_abap	kernel_7.22	cpe:2.3:a:sap:netweaver_abap:kernel_7.22:::::::*
sap	netweaver_abap	kernel_7.53	cpe:2.3:a:sap:netweaver_abap:kernel_7.53:::::::*
sap	netweaver_abap	kernel_7.54	cpe:2.3:a:sap:netweaver_abap:kernel_7.54:::::::*
sap	netweaver_abap	kernel_7.77	cpe:2.3:a:sap:netweaver_abap:kernel_7.77:::::::*
sap	netweaver_abap	kernel_7.85	cpe:2.3:a:sap:netweaver_abap:kernel_7.85:::::::*
sap	netweaver_abap	kernel_7.89	cpe:2.3:a:sap:netweaver_abap:kernel_7.89:::::::*
sap	netweaver_abap	kernel_7.93	cpe:2.3:a:sap:netweaver_abap:kernel_7.93:::::::*
sap	netweaver_abap	krnl64nuc_7.22	cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22:::::::*
sap	netweaver_abap	krnl64nuc_7.22ext	cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22ext:::::::*
sap	netweaver_abap	krnl64uc_7.22	cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.22:::::::*

Rows per page:

1-10 of 551

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "KRNL64NUC 7.22"
      },
      {
        "status": "affected",
        "version": "KRNL64NUC 7.22EXT"
      },
      {
        "status": "affected",
        "version": "KRNL64UC 7.22"
      },
      {
        "status": "affected",
        "version": "KRNL64UC 7.22EXT"
      },
      {
        "status": "affected",
        "version": "KRNL64UC 7.53"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.53"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.77"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.85"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.22_EXT"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.89"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.54"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.93"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.22"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.53"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.77"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.85"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.89"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.54"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.93"
      }
    ]
  }
]

References

me.sap.com/notes/3438085

url.sap/sapsecuritypatchday

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

AI Score

6.3

Confidence

High

EPSS

Percentile

9.5%

JSON

Related for CVE-2024-33005